CVE-2008-5077

Impact:
Important
Public Date:
2009-01-07
Bugzilla:
476671: CVE-2008-5077 OpenSSL Incorrect checks for malformed signatures

The MITRE CVE dictionary describes this issue as:

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.

Find out more about CVE-2008-5077 from the MITRE CVE dictionary dictionary and NIST NVD.

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux version 2.1 RHSA-2009:0004 2009-01-07
Red Hat Enterprise Linux version 5 RHSA-2009:0004 2009-01-07
Red Hat Enterprise Linux version 3 RHSA-2009:0004 2009-01-07
Red Hat Enterprise Linux version 4 RHSA-2009:0004 2009-01-07

Affected Packages State

Platform Package State
Red Hat Enterprise Linux version 3 openssl 0.9.7a-33.25 Fixed
Red Hat Enterprise Linux version 5 openssl 0.9.8b-10.el5_2.1 Fixed
Red Hat Enterprise Linux version 4 openssl096b 0.9.6b-22.46.el4_7 Fixed
Red Hat Linux Advanced Workstation 2.1 openssl096 0.9.6-34 Fixed
Red Hat Enterprise Linux version 4 openssl 0.9.7a-43.17.el4_7.2 Fixed
Red Hat Enterprise Linux version 3 openssl096b 0.9.6b-16.49 Fixed
Red Hat Enterprise Linux version 2.1 openssl 0.9.6b-49 Fixed
Red Hat Enterprise Linux version 5 openssl097a 0.9.7a-9.el5_2.1 Fixed
Red Hat Linux Advanced Workstation 2.1 openssl095a 0.9.5a-34 Fixed