CVE-2009-1390

Mutt - Authentication Bypass

Title source: rule

Description

Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.

References (6)

[Exploit, Patch] http://dev.mutt.org/hg/mutt/rev/64bf199c8d8a

[Exploit] http://dev.mutt.org/hg/mutt/rev/8f11dd00c770

[Patch] http://www.openwall.com/lists/oss-security/2009/06/10/2

[Patch] http://www.securityfocus.com/bid/35288

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/51068

[Vendor Advisory] https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00715.html

Scores

EPSS 0.0043

EPSS Percentile 62.6%

Classification

CWE

CWE-287

Status draft

Affected Products (1)

mutt/mutt

Timeline

Published Jun 16, 2009

Tracked Since Feb 18, 2026