CVE-2009-0653
Publication date 20 February 2009
Last updated 24 July 2024
Ubuntu priority
OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970.
Notes
mdeslaur
upstream says this was fixed in 0.9.5 http://marc.info/?l=openssl-dev&m=123603013118058&w=3