CVE-2009-0050 Security feature bypass in n/a

Medium 4.3 Published 7 Jan 2009 Updated 7 Aug 2024

Remote attackers can bypass SSL/TLS certificate validation by exploiting improper return value checks in the Lasso library's DSA verification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-0050?

CVE-2009-0050 is a medium-severity vulnerability in n/a, published on 7 Jan 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

Weakness: CWE-20

Which versions are affected by CVE-2009-0050?

It affects 1 product.

Products include Entrouvert Lasso.

How do I fix CVE-2009-0050?

Upgrade to a fixed version.

Is CVE-2009-0050 being exploited?

There is no known exploitation of CVE-2009-0050 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2009-0050, DSA-1700-1, GHSA-7ccf-7vx8-76vm.