CVSS: 5.9EPSS: 0%CPEs: 8EXPL: 0CVE-2009-2474 – neon: Improper verification of x509v3 certificate with NULL (zero) byte in certain fields
https://notcve.org/view.php?id=CVE-2009-2474
21 Aug 2009 — neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. neon, en versiones anteriores a la 0.28.6, cuando OpenSSL está habilitado, no maneja adecuadamente un caracter '\0' en un nombre de dominio, en el campo Com... • http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html • CWE-326: Inadequate Encryption Strength •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2008-3746
https://notcve.org/view.php?id=CVE-2008-3746
27 Aug 2008 — neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and crash) via vectors related to Digest authentication, Digest domain parameter support, and the parse_domain function. neon versiones 0.28.0 hasta 0.28.2, permite a servidores remotos causar una denegación de servicio (desreferencia del puntero NULL y bloqueo de aplicación) por medio de vectores relacionados con la autenticación de Digest, el soporte del parámetro domain de Digest y la función parse_dom... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476571 •