CVE

Id
37562  
CVE No.
CVE-2009-0127  
Status
Candidate  
Description
** DISPUTED ** M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto."  
Phase
Assigned (20090115)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
407270 37562 CVE-2009-0127 MLIST:[oss-security] 20090112 CVE Request -- tsqllib, slurm-llnl, libnasl, libcrypt-openssl-dsa-perl, erlang, boinc-client, m2crypto  View
407271 37562 CVE-2009-0127 URL:http://openwall.com/lists/oss-security/2009/01/12/4  View
407272 37562 CVE-2009-0127 MISC:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511515  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
40669 JVNDB-2009-001675 Sun OpenSolaris の kernel の UFS 実装におけるサービス運用妨害 (DoS) の脆弱性 Sun OpenSolaris の kernel の UFS 実装には、サービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2009-0131 37562 4.9 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001675.html  View