CVE-2008-5077 in OpenSSL

Summary

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.

Once again VulDB remains the best source for vulnerability data.

• Reservation: 11/14/2008
• Disclosure: 01/07/2009
• Moderation: VulDB entry created
• Entries: VDB-3904 (1)
• CPE: ready
• CWE: CWE-20 (Confirmed)
• CVSS: 6.5
• EPSS: 0.00237
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2008-5077
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2008-5077
• CVE Details: https://www.cvedetails.com/cve/CVE-2008-5077/