CVE-2009-0126
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for...
CVE-2009-0126 is a medium vulnerability (CVSS 5.0) in Berkeley Boinc Client, published January 15, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in boinc 6.2.14-3.
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
Exploit likelihood
What each source reports
NVD Score used
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
- Record
CVE-2009-0126- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
- Record
CVE-2009-0126- Updated
- 2026-11-02
EUVDEUVD-2009-0135 No score
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
- Record
EUVD-2009-0135- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gpcp-59gr-fj3v No score
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for...
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
- Record
GHSA-gpcp-59gr-fj3v- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
- Record
CVE-2009-0126- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0126 No score
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
- Record
DEBIAN-CVE-2009-0126- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10658-1 No score
boinc-client-7.18.0-1.2 on GA media
These are all security issues fixed in the boinc-client-7.18.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10658-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/33828
bugs.debian.org/cgi-bin/bugreport.cgi?bug=511521
lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
openwall.com/lists/oss-security/2009/01/12/4
boinc.berkeley.edu/trac/changeset/16883
Show 8 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=479664
redhat.com/archives/fedora-package-announce/2009-February/msg00034.html
nvd.nist.gov/vuln/detail/CVE-2009-0126
github.com/advisories/GHSA-gpcp-59gr-fj3v
security-tracker.debian.org/tracker/CVE-2009-0126
suse.com/security/cve/CVE-2008-5077