CoreCVE
Back

MEDIUM

Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack

Published Jun 15, 2009

Description

Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-287

Improper Authentication

References (3)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 15, 2009
Updated Aug 7, 2024
Reserved Jun 15, 2009
Link CVE-2009-2058
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2009-2058
Red Hat
Severity n/a
Public date n/a
Links CVE-2009-2058