CVE-2009-0217: ibm websphere_application_server

Modified

AliasesRHSA-2009:1428DEBIAN-CVE-2009-0217DSA-1849-1+1 more

Published 14-07-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-0217 is a medium (CVSS 5.0) vulnerability in ibm websphere_application_server. EPSS estimates a 6.36% chance of exploitation in the next 30 days, higher than 93.6% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

6.36%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10

DSA-1995-1 DTSA-205-1 RHSA-2009:1200 RHSA-2009:1201 RHSA-2009:1636 RHSA-2009:1637+4 more

Timeline

14-07-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

6.36%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 6.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat9 products

xmlsec1< 0:1.2.6-3.1 | < 0:1.2.9-8.1.1
xmlsec1-debuginfo< 0:1.2.6-3.1 | < 0:1.2.9-8.1.1
xmlsec1-devel< 0:1.2.6-3.1 | < 0:1.2.9-8.1.1
xmlsec1-gnutls< 0:1.2.9-8.1.1
xmlsec1-gnutls-devel< 0:1.2.9-8.1.1

Show all 9

Debian3 products

mono< 2.4.2.3+dfsg-1
xml-security-c< 1.2.1-3+etch1 | < 1.4.0-3+lenny2 | < 1.4.0-4
xmlsec1< 1.2.12-1

Oracle3 products

application_server10.1.2.3 | 10.1.3.4 | 10.1.4.3im
bea_product_suite8.1:sp6 | 9.0 | 9.1 | 9.2:mp3 | 10.0:mp1 | 10.3
weblogic_server_component8.1:sp6 | 9.0 | 9.1 | 9.2:mp3 | 10.0:mp1 | 10.3

Ibm1 product

websphere_application_server6.0 | 6.0.0.1 | 6.0.0.2 | 6.0.0.3 | 6.0.1 | 6.0.1.1 | 6.0.1.2 | 6.0.1.3 | 6.0.1.5 | 6.0.1.7 | 6.0.1.9 | 6.0.1.11 | 6.0.1.13 | 6.0.1.15 | 6.0.1.17 | 6.0.2 | 6.0.2.1 | 6.0.2.2 | 6.0.2.3 | 6.0.2.10 | 6.0.2.11 | 6.0.2.12 | 6.0.2.13 | 6.0.2.14 | 6.0.2.15 | 6.0.2.16 | 6.0.2.17 | 6.0.2.18 | 6.0.2.19 | 6.0.2.20 | 6.0.2.21 | 6.0.2.22 | 6.0.2.23 | 6.0.2.24 | 6.0.2.25 | 6.0.2.28 | 6.0.2.29 | 6.0.2.30 | 6.0.2.31 | 6.0.2.32 | 6.0.2.33 | 6.1 | 6.1.0 | 6.1.0.0 | 6.1.0.1 | 6.1.0.2 | 6.1.0.3 | 6.1.0.4 | 6.1.0.5 | 6.1.0.6 | 6.1.0.7 | 6.1.0.8 | 6.1.0.9 | 6.1.0.10 | 6.1.0.11 | 6.1.0.12 | 6.1.0.13 | 6.1.0.14 | 6.1.0.15 | 6.1.0.16 | 6.1.0.17 | 6.1.0.18 | 6.1.0.19 | 6.1.0.20 | 6.1.0.21 | 6.1.0.22 | 6.1.0.23 | 7.0 | 7.0.0.1

Mono_project1 product