Your message dated Tue, 22 Dec 2009 11:17:33 +0100
with message-id <[email protected]>
and subject line properly closing
has caused the Debian Bug report #539895,
regarding CVE-2009-2409: spoof certificates by using MD2 design flaws
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
539895: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539895
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nss
Version: 3.12.0-6
Severity: important
Tags: security lenny
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for nss.
CVE-2009-2409[0]:
| The NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4
| and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support
| MD2 with X.509 certificates, which might allow remote attackers to
| spoof certificates by using MD2 design flaws to generate a hash
| collision in less than brute-force time. NOTE: the scope of this
| issue is currently limited because the amount of computation required
| is still large.
The NSS library since version 3.12.3 has disabled MD2 by default, so only
the lenny version is affected.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
http://security-tracker.debian.net/tracker/CVE-2009-2409
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkp4BpYACgkQNxpp46476ap2EQCfcTQr+2RFdTqKMG0J1dBvCKqY
ddgAn14HPxWzZ6a9Ubsk5f3TKQ/k9zTD
=jhHJ
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
Version: 3.12.3-1
--- End Message ---
