CVE-2009-4565

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Published: 2010-01-04 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2009-4565 is rated Moderate Risk (55.3/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.77%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2009-4565

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-12-18 0.99% 0.77% -0.22%
2 2025-12-17 0.77% 0.99% +0.22%
3 2025-12-10 — 0.77% —

Full EPSS history (17 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2009-4565

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 2.0 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 10.0 6.4 [email protected]

Weakness enumeration for CVE-2009-4565

OS Trackers for CVE-2009-4565

vendor priority summary link
debian medium CVE-2009-4565 medium priority: Debian including 1 source packages (sendmail), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2009-4565
gentoo normal CVE-2009-4565: 1 GLSA(s) (201206-30), 1 atom(s) (mail-mta/sendmail); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2009-4565
redhat low — https://access.redhat.com/security/cve/CVE-2009-4565
ubuntu medium CVE-2009-4565 medium priority: Ubuntu including 1 source packages (sendmail), 10 status rows across 10 suites (dapper, hardy, intrepid, jaunty, karmic, lucid, maverick, natty, oneiric, upstream): ignored 5, not-affected 4, released 1. https://ubuntu.com/security/CVE-2009-4565

Vendor comments (NVD) for CVE-2009-4565

  • Red Hat (2010-01-21T00:00:00)

    Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2009-4565 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.

Affected software / configurations for CVE-2009-4565

Vendor Product Version Raw CPE
sendmail sendmail <= 8.14.3 cpe:2.3:a:sendmail:sendmail:*:*:*:*:*:*:*:*
sendmail sendmail 2.6 cpe:2.3:a:sendmail:sendmail:2.6:*:*:*:*:*:*:*
sendmail sendmail 2.6.1 cpe:2.3:a:sendmail:sendmail:2.6.1:*:*:*:*:*:*:*
sendmail sendmail 3.0 cpe:2.3:a:sendmail:sendmail:3.0:*:*:*:*:*:*:*
sendmail sendmail 3.0.1 cpe:2.3:a:sendmail:sendmail:3.0.1:*:*:*:*:*:*:*
sendmail sendmail 4.1 cpe:2.3:a:sendmail:sendmail:4.1:*:*:*:*:*:*:*
sendmail sendmail 4.55 cpe:2.3:a:sendmail:sendmail:4.55:*:*:*:*:*:*:*
sendmail sendmail 5 cpe:2.3:a:sendmail:sendmail:5:*:*:*:*:*:*:*
sendmail sendmail 5.59 cpe:2.3:a:sendmail:sendmail:5.59:*:*:*:*:*:*:*
sendmail sendmail 5.61 cpe:2.3:a:sendmail:sendmail:5.61:*:*:*:*:*:*:*
sendmail sendmail 5.65 cpe:2.3:a:sendmail:sendmail:5.65:*:*:*:*:*:*:*
sendmail sendmail 8.6.7 cpe:2.3:a:sendmail:sendmail:8.6.7:*:*:*:*:*:*:*
sendmail sendmail 8.7.6 cpe:2.3:a:sendmail:sendmail:8.7.6:*:*:*:*:*:*:*
sendmail sendmail 8.7.7 cpe:2.3:a:sendmail:sendmail:8.7.7:*:*:*:*:*:*:*
sendmail sendmail 8.7.8 cpe:2.3:a:sendmail:sendmail:8.7.8:*:*:*:*:*:*:*
sendmail sendmail 8.7.9 cpe:2.3:a:sendmail:sendmail:8.7.9:*:*:*:*:*:*:*
sendmail sendmail 8.7.10 cpe:2.3:a:sendmail:sendmail:8.7.10:*:*:*:*:*:*:*
sendmail sendmail 8.8.8 cpe:2.3:a:sendmail:sendmail:8.8.8:*:*:*:*:*:*:*
sendmail sendmail 8.9.0 cpe:2.3:a:sendmail:sendmail:8.9.0:*:*:*:*:*:*:*
sendmail sendmail 8.9.1 cpe:2.3:a:sendmail:sendmail:8.9.1:*:*:*:*:*:*:*
sendmail sendmail 8.9.2 cpe:2.3:a:sendmail:sendmail:8.9.2:*:*:*:*:*:*:*
sendmail sendmail 8.9.3 cpe:2.3:a:sendmail:sendmail:8.9.3:*:*:*:*:*:*:*
sendmail sendmail 8.10 cpe:2.3:a:sendmail:sendmail:8.10:*:*:*:*:*:*:*
sendmail sendmail 8.10.0 cpe:2.3:a:sendmail:sendmail:8.10.0:*:*:*:*:*:*:*
sendmail sendmail 8.10.1 cpe:2.3:a:sendmail:sendmail:8.10.1:*:*:*:*:*:*:*
sendmail sendmail 8.10.2 cpe:2.3:a:sendmail:sendmail:8.10.2:*:*:*:*:*:*:*
sendmail sendmail 8.11.0 cpe:2.3:a:sendmail:sendmail:8.11.0:*:*:*:*:*:*:*
sendmail sendmail 8.11.1 cpe:2.3:a:sendmail:sendmail:8.11.1:*:*:*:*:*:*:*
sendmail sendmail 8.11.2 cpe:2.3:a:sendmail:sendmail:8.11.2:*:*:*:*:*:*:*
sendmail sendmail 8.11.3 cpe:2.3:a:sendmail:sendmail:8.11.3:*:*:*:*:*:*:*
sendmail sendmail 8.11.4 cpe:2.3:a:sendmail:sendmail:8.11.4:*:*:*:*:*:*:*
sendmail sendmail 8.11.5 cpe:2.3:a:sendmail:sendmail:8.11.5:*:*:*:*:*:*:*
sendmail sendmail 8.11.6 cpe:2.3:a:sendmail:sendmail:8.11.6:*:*:*:*:*:*:*
sendmail sendmail 8.11.7 cpe:2.3:a:sendmail:sendmail:8.11.7:*:*:*:*:*:*:*
sendmail sendmail 8.12 cpe:2.3:a:sendmail:sendmail:8.12:beta10:*:*:*:*:*:*
sendmail sendmail 8.12 cpe:2.3:a:sendmail:sendmail:8.12:beta12:*:*:*:*:*:*
sendmail sendmail 8.12 cpe:2.3:a:sendmail:sendmail:8.12:beta16:*:*:*:*:*:*
sendmail sendmail 8.12 cpe:2.3:a:sendmail:sendmail:8.12:beta5:*:*:*:*:*:*
sendmail sendmail 8.12 cpe:2.3:a:sendmail:sendmail:8.12:beta7:*:*:*:*:*:*
sendmail sendmail 8.12.0 cpe:2.3:a:sendmail:sendmail:8.12.0:*:*:*:*:*:*:*
sendmail sendmail 8.12.1 cpe:2.3:a:sendmail:sendmail:8.12.1:*:*:*:*:*:*:*
sendmail sendmail 8.12.2 cpe:2.3:a:sendmail:sendmail:8.12.2:*:*:*:*:*:*:*
sendmail sendmail 8.12.3 cpe:2.3:a:sendmail:sendmail:8.12.3:*:*:*:*:*:*:*
sendmail sendmail 8.12.4 cpe:2.3:a:sendmail:sendmail:8.12.4:*:*:*:*:*:*:*
sendmail sendmail 8.12.5 cpe:2.3:a:sendmail:sendmail:8.12.5:*:*:*:*:*:*:*
sendmail sendmail 8.12.6 cpe:2.3:a:sendmail:sendmail:8.12.6:*:*:*:*:*:*:*
sendmail sendmail 8.12.7 cpe:2.3:a:sendmail:sendmail:8.12.7:*:*:*:*:*:*:*
sendmail sendmail 8.12.8 cpe:2.3:a:sendmail:sendmail:8.12.8:*:*:*:*:*:*:*
sendmail sendmail 8.12.9 cpe:2.3:a:sendmail:sendmail:8.12.9:*:*:*:*:*:*:*
sendmail sendmail 8.12.10 cpe:2.3:a:sendmail:sendmail:8.12.10:*:*:*:*:*:*:*
sendmail sendmail 8.13.0 cpe:2.3:a:sendmail:sendmail:8.13.0:*:*:*:*:*:*:*
sendmail sendmail 8.13.1 cpe:2.3:a:sendmail:sendmail:8.13.1:*:*:*:*:*:*:*
sendmail sendmail 8.13.1.2 cpe:2.3:a:sendmail:sendmail:8.13.1.2:*:*:*:*:*:*:*
sendmail sendmail 8.13.2 cpe:2.3:a:sendmail:sendmail:8.13.2:*:*:*:*:*:*:*
sendmail sendmail 8.13.3 cpe:2.3:a:sendmail:sendmail:8.13.3:*:*:*:*:*:*:*
sendmail sendmail 8.13.4 cpe:2.3:a:sendmail:sendmail:8.13.4:*:*:*:*:*:*:*
sendmail sendmail 8.13.5 cpe:2.3:a:sendmail:sendmail:8.13.5:*:*:*:*:*:*:*
sendmail sendmail 8.13.6 cpe:2.3:a:sendmail:sendmail:8.13.6:*:*:*:*:*:*:*
sendmail sendmail 8.13.7 cpe:2.3:a:sendmail:sendmail:8.13.7:*:*:*:*:*:*:*
sendmail sendmail 8.13.8 cpe:2.3:a:sendmail:sendmail:8.13.8:*:*:*:*:*:*:*
sendmail sendmail 8.14.1 cpe:2.3:a:sendmail:sendmail:8.14.1:*:*:*:*:*:*:*
sendmail sendmail 8.14.2 cpe:2.3:a:sendmail:sendmail:8.14.2:*:*:*:*:*:*:*

References for CVE-2009-4565

URL Tags
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
http://marc.info/?l=bugtraq&m=126953289726317&w=2
http://secunia.com/advisories/37998 Vendor Advisory
http://secunia.com/advisories/38314
http://secunia.com/advisories/38915
http://secunia.com/advisories/39088
http://secunia.com/advisories/40109
http://secunia.com/advisories/43366
http://security.gentoo.org/glsa/glsa-201206-30.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021797.1-1
http://www.debian.org/security/2010/dsa-1985
http://www.redhat.com/support/errata/RHSA-2011-0262.html
http://www.securityfocus.com/bid/37543
http://www.sendmail.org/releases/8.14.4 Patch
http://www.vupen.com/english/advisories/2009/3661 Patch Vendor Advisory
http://www.vupen.com/english/advisories/2010/0719
http://www.vupen.com/english/advisories/2010/1386
http://www.vupen.com/english/advisories/2011/0415
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10255
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11822
cvelogic Threat Intelligence