PT-2009-6710 · Openssl+1 · Openssl+1
Published
1970-01-01
·
Updated
2025-01-21
·
CVE-2008-5077
CVSS v2.0
5.8
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 0.9.8i and earlier
Description
The issue allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. Exploitation of this issue can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely.
Recommendations
For OpenSSL versions 0.9.8i and earlier, update to a version later than 0.9.8i to resolve the issue. As a temporary workaround, consider disabling the use of DSA and ECDSA keys until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openssl
Red Hat