CVE-2009-3291 Security feature bypass in n/a
Attackers can bypass certificate validation in PHP's OpenSSL extension, potentially allowing certificate spoofing and man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-3291?
CVE-2009-3291 is a high-severity vulnerability in Php Php, published on 22 Sep 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates.
Weakness: CWE-20
Which versions are affected by CVE-2009-3291?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2009-3291?
Upgrade to a fixed version.
Is CVE-2009-3291 being exploited?
There is no known exploitation of CVE-2009-3291 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-pj82-fpwx-65j3.