CVE-2008-5077

EPSS 0.24%

openssl openssl097 - cryptographic weakness

Published: 1/7/2009Modified: 4/28/2026

Description

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.

Affected packages (3)

Debian/opensslfrom 0, < 0.9.8g-15
Debian/opensslfrom 0, < 0.9.8c-4etch4
Debian/openssl097from 0, < 0.9.7k-3.1etch2

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2008-5077