5.8

CVE-2008-5077

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.

Data is provided by the National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version <= 0.9.8h
OpenSSL ≫ OpenSSL Version0.9.1c
OpenSSL ≫ OpenSSL Version0.9.2b
OpenSSL ≫ OpenSSL Version0.9.3
OpenSSL ≫ OpenSSL Version0.9.3a
OpenSSL ≫ OpenSSL Version0.9.4
OpenSSL ≫ OpenSSL Version0.9.5
OpenSSL ≫ OpenSSL Version0.9.5 Updatebeta1
OpenSSL ≫ OpenSSL Version0.9.5 Updatebeta2
OpenSSL ≫ OpenSSL Version0.9.5a
OpenSSL ≫ OpenSSL Version0.9.5a Updatebeta1
OpenSSL ≫ OpenSSL Version0.9.5a Updatebeta2
OpenSSL ≫ OpenSSL Version0.9.6
OpenSSL ≫ OpenSSL Version0.9.6 Updatebeta1
OpenSSL ≫ OpenSSL Version0.9.6 Updatebeta2
OpenSSL ≫ OpenSSL Version0.9.6 Updatebeta3
OpenSSL ≫ OpenSSL Version0.9.6a
OpenSSL ≫ OpenSSL Version0.9.6a Updatebeta1
OpenSSL ≫ OpenSSL Version0.9.6a Updatebeta2
OpenSSL ≫ OpenSSL Version0.9.6a Updatebeta3
OpenSSL ≫ OpenSSL Version0.9.6b
OpenSSL ≫ OpenSSL Version0.9.6c
OpenSSL ≫ OpenSSL Version0.9.6d
OpenSSL ≫ OpenSSL Version0.9.6e
OpenSSL ≫ OpenSSL Version0.9.6f
OpenSSL ≫ OpenSSL Version0.9.6g
OpenSSL ≫ OpenSSL Version0.9.6h
OpenSSL ≫ OpenSSL Version0.9.6i
OpenSSL ≫ OpenSSL Version0.9.6j
OpenSSL ≫ OpenSSL Version0.9.6k
OpenSSL ≫ OpenSSL Version0.9.6l
OpenSSL ≫ OpenSSL Version0.9.6m
OpenSSL ≫ OpenSSL Version0.9.7
OpenSSL ≫ OpenSSL Version0.9.7 Updatebeta1
OpenSSL ≫ OpenSSL Version0.9.7 Updatebeta2
OpenSSL ≫ OpenSSL Version0.9.7 Updatebeta3
OpenSSL ≫ OpenSSL Version0.9.7 Updatebeta4
OpenSSL ≫ OpenSSL Version0.9.7 Updatebeta5
OpenSSL ≫ OpenSSL Version0.9.7 Updatebeta6
OpenSSL ≫ OpenSSL Version0.9.7a
OpenSSL ≫ OpenSSL Version0.9.7b
OpenSSL ≫ OpenSSL Version0.9.7c
OpenSSL ≫ OpenSSL Version0.9.7d
OpenSSL ≫ OpenSSL Version0.9.7e
OpenSSL ≫ OpenSSL Version0.9.7f
OpenSSL ≫ OpenSSL Version0.9.7g
OpenSSL ≫ OpenSSL Version0.9.7h
OpenSSL ≫ OpenSSL Version0.9.7i
OpenSSL ≫ OpenSSL Version0.9.7j
OpenSSL ≫ OpenSSL Version0.9.7k
OpenSSL ≫ OpenSSL Version0.9.7l
OpenSSL ≫ OpenSSL Version0.9.8
OpenSSL ≫ OpenSSL Version0.9.8a
OpenSSL ≫ OpenSSL Version0.9.8b
OpenSSL ≫ OpenSSL Version0.9.8c
OpenSSL ≫ OpenSSL Version0.9.8d
OpenSSL ≫ OpenSSL Version0.9.8e
OpenSSL ≫ OpenSSL Version0.9.8f
OpenSSL ≫ OpenSSL Version0.9.8g
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.04% 0.768
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:N/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.