Google Chrome before 2.0.172.43 does not prevent SSL connections to a site with an X.509 certificate signed with the (1) MD2 or (2) MD4 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary HTTPS servers via a crafted certificate, a related issue to CVE-2009-2409.
2009-08-27T17:30:00.297
2025-04-09T00:30:58.490
Deferred
CVSSv2: 6.4 (MEDIUM)
AV:N/AC:L/Au:N/C:N/I:P/A:P
10.0
4.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | chrome | ≤ 2.0.172.37 | Yes | |
| Application | chrome | 0.2.149.27 | Yes | |
| Application | chrome | 0.2.149.29 | Yes | |
| Application | chrome | 0.2.149.30 | Yes | |
| Application | chrome | 0.2.152.1 | Yes | |
| Application | chrome | 0.2.153.1 | Yes | |
| Application | chrome | 0.3.154.0 | Yes | |
| Application | chrome | 0.3.154.3 | Yes | |
| Application | chrome | 0.4.154.18 | Yes | |
| Application | chrome | 0.4.154.22 | Yes | |
| Application | chrome | 0.4.154.31 | Yes | |
| Application | chrome | 0.4.154.33 | Yes | |
| Application | chrome | 1.0.154.36 | Yes | |
| Application | chrome | 1.0.154.39 | Yes | |
| Application | chrome | 1.0.154.42 | Yes | |
| Application | chrome | 1.0.154.43 | Yes | |
| Application | chrome | 1.0.154.46 | Yes | |
| Application | chrome | 1.0.154.48 | Yes | |
| Application | chrome | 1.0.154.52 | Yes | |
| Application | chrome | 1.0.154.53 | Yes | |
| Application | chrome | 1.0.154.59 | Yes | |
| Application | chrome | 2.0.156.1 | Yes | |
| Application | chrome | 2.0.157.0 | Yes | |
| Application | chrome | 2.0.157.2 | Yes | |
| Application | chrome | 2.0.158.0 | Yes | |
| Application | chrome | 2.0.159.0 | Yes | |
| Application | chrome | 2.0.172 | Yes | |
| Application | chrome | 2.0.172.30 | Yes | |
| Application | chrome | 2.0.172.31 | Yes | |
| Application | chrome | 2.0.172.33 | Yes |