CVE-2009-0127

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2009-0127
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2009-0127.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2009-0127
Downstream
Published
2009-01-15T17:30:00Z
Modified
2026-04-10T03:40:32Z
Summary
[none]
Details

M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto.

Database specific 
{
    "isDisputed": true
}
References

Affected packages