CVE-2009-0591

The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes…

published March 27, 2009

CVSS
—
EPSS
3%
Percentile
86.0
In the wild
Unconfirmed
What it is

The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02735 · 86.0th percentile
Published
2009-03-27T16:00Z
EPSS history
Timeline
  • 27 MAR 16:00Z
    The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes…
    cvelistv5