CVE-2009-3555 Apache Tomcat affected by vulnerability in TLS and SSL protocol

What is CVE-2009-3555?

CVE-2009-3555 is a critical vulnerability in Apache Http Server, published on 9 Nov 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.

Weakness: CWE-295, CWE-300

Which versions are affected by CVE-2009-3555?

6 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 8 products.

Products include Apache Http Server, Canonical Ubuntu Linux, Debian Debian Linux, F5 Nginx, Fedoraproject Fedora, Gnu Gnutls and 2 more.

How do I fix CVE-2009-3555?

Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 5.5.33, 6.0.32 or 7.0.10.

Is CVE-2009-3555 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-3555 exists.

Public exploit code: 2 Exploit-DB entries and 1 proofs of concept on GitHub.

Other vulnerabilities in Apache Http Server

• CVE-2021-42013 Apache HTTP Server Path Traversal Exploited Critical 9.8
• CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Exploited Critical 9.1
• CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF) Exploited Critical 9.0
• CVE-2019-0211 Apache HTTP Server Privilege Escalation Exploited High 7.8
• CVE-2021-41773 Apache HTTP Server Path Traversal Exploited High 7.5

All Apache Http Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2009-3555, DSA-2141-2, GHSA-f7w7-6pjc-wwm6, RHSA-2010:0155, RHSA-2010:0164, RHSA-2010:0165.