CVE-2009-0126

The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the…

published January 15, 2009

CVSS
—
EPSS
2%
Percentile
84.0
In the wild
Unconfirmed
What it is

The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02420 · 84.0th percentile
Published
2009-01-15T17:00Z
EPSS history
Timeline
  • 15 JAN 17:00Z
    The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the…
    cvelistv5