When checking my (secure) site https://www.just-great-software.com/ with Firefox 3.6.6 the Error Console shows:

www.just-great-software.com : potentially vulnerable to CVE-2009-3555

Is this something I need to worry about? Is there an easy way for me to check whether the vulnerability actually exists on my server?


The Mitre Web Site will tell you the details of the vulnerability e.g. what software it affects, links to vendors responses and so on:


Mitre also provides a link to National Vulnerability Database (very useful):


The NVD site give you (in my opinion) an unbiased statement on the severity of the problem. That should help you decide how much of a priority you give this problem but that will also depend on what your site provides, whether you have PCI DSS obligations etc.

So now we know that 2009-3555 is an SSL protocol vulnerability so affects the openssl package, openjdk package etc.

Then follow the link to your vendor's response to the incident. The RedHat one is a good write up of this particular problem so I'll follow that:


You can check the packages on your server by looking at the changelog for the openssl rpm installed:

# rpm -q --changelog openssl | grep CVE
- fix CVE-2009-1386 CVE-2009-1387 (DTLS DoS problems)
- fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
- fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)

We don't see CVE-2009-3555 so this rpm is potentially vulnerable and should be replaced.

Obtain the recommended replacement for openssl from your vendor, apply Repeat this for all the packages the vendor recommends in the response and you are done.



Check the versions of the software on your server with those in the vulnerability report, and if you are running some variant of RHEL then also check the package changelogs to see if the security fix has been backported.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.