CVE-2008-5077
- State
- Published
- Severity
- Not scored
- Published
- Jan 7, 2009
- Updated
- Aug 7, 2024
- Reserved
- Nov 14, 2008
Description
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- SSRT090002vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0004.html
- SUSE-SU-2011:0847vendor-advisory
- http://support.apple.com/kb/HT3549
- 20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misusesmailing-list
- 250826vendor-advisory
- http://www.openssl.org/news/secadv_20090107.txt
- ADV-2009-0558vdb-entry
- openSUSE-SU-2011:0845vendor-advisory
- 1021523vdb-entry
- ADV-2009-0362vdb-entry
- GLSA-200902-02vendor-advisory
- HPSBMA02426vendor-advisory
- ADV-2009-0289vdb-entry
- 35074third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-038.htm
- 34211third-party-advisory
- ADV-2009-0040vdb-entry
- HPSBOV02540vendor-advisory
- APPLE-SA-2009-05-12vendor-advisory
- SSA:2009-014-01vendor-advisory
- ADV-2009-0904vdb-entry
- ADV-2009-0913vdb-entry
- 33557third-party-advisory
- 33765third-party-advisory
- http://www.ocert.org/advisories/ocert-2008-016.html
- 33673third-party-advisory
- 20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vimmailing-list
- 33436third-party-advisory
- 35108third-party-advisory
- TA09-133Athird-party-advisory
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=837653
- 33150vdb-entry
- RHSA-2009:0004vendor-advisory
- ADV-2009-1297vdb-entry
- USN-704-1vendor-advisory
- 33338third-party-advisory
- ADV-2009-1338vdb-entry
- 33394third-party-advisory
- http://voodoo-circle.sourceforge.net/sa/sa-20090123-01.html
- oval:org.mitre.oval:def:6380vdb-entrysignature
- 39005third-party-advisory
- oval:org.mitre.oval:def:9155vdb-entrysignature
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.