Auth bypass in Openssl

CVE-2009-0591

The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.

Vulnerability class: Broken Authentication

EPSS: 0.027 (84.6th percentile) — read the EPSS interpretation.

Affected products

  • Openssl — versions 0.9.8h, 0.9.8i, 0.9.8j
  • N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2009-0591?
CVE-2009-0591 is a vulnerability in Openssl, classified under Improper Authentication. Published 2009-03-27.
Is CVE-2009-0591 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.