Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

Published

2009-07-14T23:30:00.187

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ibm	websphere_application_server	6.0	Yes
Application	ibm	websphere_application_server	6.0.0.1	Yes
Application	ibm	websphere_application_server	6.0.0.2	Yes
Application	ibm	websphere_application_server	6.0.0.3	Yes
Application	ibm	websphere_application_server	6.0.1	Yes
Application	ibm	websphere_application_server	6.0.1.1	Yes
Application	ibm	websphere_application_server	6.0.1.2	Yes
Application	ibm	websphere_application_server	6.0.1.3	Yes
Application	ibm	websphere_application_server	6.0.1.5	Yes
Application	ibm	websphere_application_server	6.0.1.7	Yes
Application	ibm	websphere_application_server	6.0.1.9	Yes
Application	ibm	websphere_application_server	6.0.1.11	Yes
Application	ibm	websphere_application_server	6.0.1.13	Yes
Application	ibm	websphere_application_server	6.0.1.15	Yes
Application	ibm	websphere_application_server	6.0.1.17	Yes
Application	ibm	websphere_application_server	6.0.2	Yes
Application	ibm	websphere_application_server	6.0.2	Yes
Application	ibm	websphere_application_server	6.0.2.1	Yes
Application	ibm	websphere_application_server	6.0.2.2	Yes
Application	ibm	websphere_application_server	6.0.2.3	Yes
Application	ibm	websphere_application_server	6.0.2.10	Yes
Application	ibm	websphere_application_server	6.0.2.11	Yes
Application	ibm	websphere_application_server	6.0.2.12	Yes
Application	ibm	websphere_application_server	6.0.2.13	Yes
Application	ibm	websphere_application_server	6.0.2.14	Yes
Application	ibm	websphere_application_server	6.0.2.15	Yes
Application	ibm	websphere_application_server	6.0.2.16	Yes
Application	ibm	websphere_application_server	6.0.2.17	Yes
Application	ibm	websphere_application_server	6.0.2.18	Yes
Application	ibm	websphere_application_server	6.0.2.19	Yes
Application	ibm	websphere_application_server	6.0.2.20	Yes
Application	ibm	websphere_application_server	6.0.2.21	Yes
Application	ibm	websphere_application_server	6.0.2.22	Yes
Application	ibm	websphere_application_server	6.0.2.23	Yes
Application	ibm	websphere_application_server	6.0.2.24	Yes
Application	ibm	websphere_application_server	6.0.2.25	Yes
Application	ibm	websphere_application_server	6.0.2.28	Yes
Application	ibm	websphere_application_server	6.0.2.29	Yes
Application	ibm	websphere_application_server	6.0.2.30	Yes
Application	ibm	websphere_application_server	6.0.2.31	Yes
Application	ibm	websphere_application_server	6.0.2.32	Yes
Application	ibm	websphere_application_server	6.0.2.33	Yes
Application	ibm	websphere_application_server	6.1	Yes
Application	ibm	websphere_application_server	6.1.0	Yes
Application	ibm	websphere_application_server	6.1.0.0	Yes
Application	ibm	websphere_application_server	6.1.0.1	Yes
Application	ibm	websphere_application_server	6.1.0.2	Yes
Application	ibm	websphere_application_server	6.1.0.3	Yes
Application	ibm	websphere_application_server	6.1.0.4	Yes
Application	ibm	websphere_application_server	6.1.0.5	Yes
Application	ibm	websphere_application_server	6.1.0.6	Yes
Application	ibm	websphere_application_server	6.1.0.7	Yes
Application	ibm	websphere_application_server	6.1.0.8	Yes
Application	ibm	websphere_application_server	6.1.0.9	Yes
Application	ibm	websphere_application_server	6.1.0.10	Yes
Application	ibm	websphere_application_server	6.1.0.11	Yes
Application	ibm	websphere_application_server	6.1.0.12	Yes
Application	ibm	websphere_application_server	6.1.0.13	Yes
Application	ibm	websphere_application_server	6.1.0.14	Yes
Application	ibm	websphere_application_server	6.1.0.15	Yes
Application	ibm	websphere_application_server	6.1.0.16	Yes
Application	ibm	websphere_application_server	6.1.0.17	Yes
Application	ibm	websphere_application_server	6.1.0.18	Yes
Application	ibm	websphere_application_server	6.1.0.19	Yes
Application	ibm	websphere_application_server	6.1.0.20	Yes
Application	ibm	websphere_application_server	6.1.0.21	Yes
Application	ibm	websphere_application_server	6.1.0.22	Yes
Application	ibm	websphere_application_server	6.1.0.23	Yes
Application	ibm	websphere_application_server	7.0	Yes
Application	ibm	websphere_application_server	7.0.0.1	Yes
Application	mono_project	mono	1.2.1	Yes
Application	mono_project	mono	1.2.2	Yes
Application	mono_project	mono	1.2.3	Yes
Application	mono_project	mono	1.2.4	Yes
Application	mono_project	mono	1.2.5	Yes
Application	mono_project	mono	1.2.6	Yes
Application	mono_project	mono	1.9	Yes
Application	mono_project	mono	2.0	Yes
Application	oracle	application_server	10.1.2.3	Yes
Application	oracle	application_server	10.1.3.4	Yes
Application	oracle	application_server	10.1.4.3im	Yes
Application	oracle	bea_product_suite	8.1	Yes
Application	oracle	bea_product_suite	9.0	Yes
Application	oracle	bea_product_suite	9.1	Yes
Application	oracle	bea_product_suite	9.2	Yes
Application	oracle	bea_product_suite	10.0	Yes
Application	oracle	bea_product_suite	10.3	Yes
Application	oracle	weblogic_server_component	8.1	Yes
Application	oracle	weblogic_server_component	9.0	Yes
Application	oracle	weblogic_server_component	9.1	Yes
Application	oracle	weblogic_server_component	9.2	Yes
Application	oracle	weblogic_server_component	10.0	Yes
Application	oracle	weblogic_server_component	10.3	Yes

References

http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161 ([email protected])
http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7 ([email protected])
http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7 ([email protected])
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html ([email protected])
http://marc.info/?l=bugtraq&m=125787273209737&w=2 ([email protected])
http://marc.info/?l=bugtraq&m=125787273209737&w=2 ([email protected])
http://osvdb.org/55895 ([email protected])
http://osvdb.org/55907 ([email protected])
http://secunia.com/advisories/34461 ([email protected])
http://secunia.com/advisories/35776 Vendor Advisory ([email protected])
http://secunia.com/advisories/35852 Vendor Advisory ([email protected])
http://secunia.com/advisories/35853 Vendor Advisory ([email protected])
http://secunia.com/advisories/35854 Vendor Advisory ([email protected])
http://secunia.com/advisories/35855 Vendor Advisory ([email protected])
http://secunia.com/advisories/35858 Vendor Advisory ([email protected])
http://secunia.com/advisories/36162 Vendor Advisory ([email protected])
http://secunia.com/advisories/36176 Vendor Advisory ([email protected])
http://secunia.com/advisories/36180 Vendor Advisory ([email protected])
http://secunia.com/advisories/36494 Vendor Advisory ([email protected])
http://secunia.com/advisories/37300 ([email protected])
http://secunia.com/advisories/37671 ([email protected])
http://secunia.com/advisories/37841 ([email protected])
http://secunia.com/advisories/38567 ([email protected])
http://secunia.com/advisories/38568 ([email protected])
http://secunia.com/advisories/38695 ([email protected])
http://secunia.com/advisories/38921 ([email protected])
http://secunia.com/advisories/41818 ([email protected])
http://secunia.com/advisories/60799 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1 ([email protected])
http://svn.apache.org/viewvc?revision=794013&view=revision ([email protected])
http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere Patch, Vendor Advisory ([email protected])
http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere Patch, Vendor Advisory ([email protected])
http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925 Patch, Vendor Advisory ([email protected])
http://www.aleksey.com/xmlsec/ ([email protected])
http://www.debian.org/security/2010/dsa-1995 ([email protected])
http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml ([email protected])
http://www.kb.cert.org/vuls/id/466161 US Government Resource ([email protected])
http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ ([email protected])
http://www.kb.cert.org/vuls/id/WDON-7TY529 ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209 ([email protected])
http://www.mono-project.com/Vulnerabilities Vendor Advisory ([email protected])
http://www.openoffice.org/security/cves/CVE-2009-0217.html ([email protected])
http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html ([email protected])
http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html ([email protected])
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html ([email protected])
http://www.redhat.com/support/errata/RHSA-2009-1694.html ([email protected])
http://www.securityfocus.com/bid/35671 Patch ([email protected])
http://www.securitytracker.com/id?1022561 ([email protected])
http://www.securitytracker.com/id?1022567 ([email protected])
http://www.securitytracker.com/id?1022661 ([email protected])
http://www.ubuntu.com/usn/USN-903-1 ([email protected])
http://www.us-cert.gov/cas/techalerts/TA09-294A.html US Government Resource ([email protected])
http://www.us-cert.gov/cas/techalerts/TA10-159B.html US Government Resource ([email protected])
http://www.vupen.com/english/advisories/2009/1900 Patch, Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/1908 Patch, Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/1909 Patch, Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/1911 Patch, Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/2543 ([email protected])
http://www.vupen.com/english/advisories/2009/3122 ([email protected])
http://www.vupen.com/english/advisories/2010/0366 ([email protected])
http://www.vupen.com/english/advisories/2010/0635 ([email protected])
http://www.w3.org/2008/06/xmldsigcore-errata.html#e03 Vendor Advisory ([email protected])
http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=511915 ([email protected])
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041 ([email protected])
https://issues.apache.org/bugzilla/show_bug.cgi?id=47526 ([email protected])
https://issues.apache.org/bugzilla/show_bug.cgi?id=47527 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717 ([email protected])
https://rhn.redhat.com/errata/RHSA-2009-1200.html ([email protected])
https://rhn.redhat.com/errata/RHSA-2009-1201.html ([email protected])
https://rhn.redhat.com/errata/RHSA-2009-1428.html ([email protected])
https://rhn.redhat.com/errata/RHSA-2009-1636.html ([email protected])
https://rhn.redhat.com/errata/RHSA-2009-1637.html ([email protected])
https://rhn.redhat.com/errata/RHSA-2009-1649.html ([email protected])
https://rhn.redhat.com/errata/RHSA-2009-1650.html ([email protected])
https://usn.ubuntu.com/826-1/ ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html ([email protected])
http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161 (af854a3a-2127-422b-91ae-364da2661108)
http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7 (af854a3a-2127-422b-91ae-364da2661108)
http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7 (af854a3a-2127-422b-91ae-364da2661108)
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html (af854a3a-2127-422b-91ae-364da2661108)
http://marc.info/?l=bugtraq&m=125787273209737&w=2 (af854a3a-2127-422b-91ae-364da2661108)
http://marc.info/?l=bugtraq&m=125787273209737&w=2 (af854a3a-2127-422b-91ae-364da2661108)
http://osvdb.org/55895 (af854a3a-2127-422b-91ae-364da2661108)
http://osvdb.org/55907 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34461 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35776 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35852 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35853 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35854 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35855 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35858 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/36162 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/36176 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/36180 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/36494 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/37300 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/37671 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/37841 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/38567 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/38568 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/38695 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/38921 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/41818 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/60799 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-263429-1 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269208-1 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020710.1-1 (af854a3a-2127-422b-91ae-364da2661108)
http://svn.apache.org/viewvc?revision=794013&view=revision (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023545&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?rs=180&context=SSEQTP&dc=D400&uid=swg24023723&loc=en_US&cs=UTF-8&lang=en&rss=ct180websphere Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21384925 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.aleksey.com/xmlsec/ (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2010/dsa-1995 (af854a3a-2127-422b-91ae-364da2661108)
http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/466161 US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/MAPG-7TSKXQ (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/WDON-7TY529 (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209 (af854a3a-2127-422b-91ae-364da2661108)
http://www.mono-project.com/Vulnerabilities Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openoffice.org/security/cves/CVE-2009-0217.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2009-1694.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/35671 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1022561 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1022567 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1022661 (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-903-1 (af854a3a-2127-422b-91ae-364da2661108)
http://www.us-cert.gov/cas/techalerts/TA09-294A.html US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.us-cert.gov/cas/techalerts/TA10-159B.html US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1900 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1908 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1909 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1911 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/2543 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/3122 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2010/0366 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2010/0635 (af854a3a-2127-422b-91ae-364da2661108)
http://www.w3.org/2008/06/xmldsigcore-errata.html#e03 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.w3.org/QA/2009/07/hmac_truncation_in_xml_signatu.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=511915 (af854a3a-2127-422b-91ae-364da2661108)
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-041 (af854a3a-2127-422b-91ae-364da2661108)
https://issues.apache.org/bugzilla/show_bug.cgi?id=47526 (af854a3a-2127-422b-91ae-364da2661108)
https://issues.apache.org/bugzilla/show_bug.cgi?id=47527 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10186 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7158 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8717 (af854a3a-2127-422b-91ae-364da2661108)
https://rhn.redhat.com/errata/RHSA-2009-1200.html (af854a3a-2127-422b-91ae-364da2661108)
https://rhn.redhat.com/errata/RHSA-2009-1201.html (af854a3a-2127-422b-91ae-364da2661108)
https://rhn.redhat.com/errata/RHSA-2009-1428.html (af854a3a-2127-422b-91ae-364da2661108)
https://rhn.redhat.com/errata/RHSA-2009-1636.html (af854a3a-2127-422b-91ae-364da2661108)
https://rhn.redhat.com/errata/RHSA-2009-1637.html (af854a3a-2127-422b-91ae-364da2661108)
https://rhn.redhat.com/errata/RHSA-2009-1649.html (af854a3a-2127-422b-91ae-364da2661108)
https://rhn.redhat.com/errata/RHSA-2009-1650.html (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/826-1/ (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00494.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00505.html (af854a3a-2127-422b-91ae-364da2661108)