CVE-2009-0127
** DISPUTED ** M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal...
M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto.
Exploit likelihood
What each source reports
NVD Score used
M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto.
- Record
CVE-2009-0127- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto.
- Record
CVE-2009-0127- Updated
- 2026-11-02
EUVDEUVD-2009-0136 No score
M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto.
- Record
EUVD-2009-0136- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-933f-4fwg-646j No score
** DISPUTED ** M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal...
** DISPUTED ** M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto."
- Record
GHSA-933f-4fwg-646j- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto.
- Record
CVE-2009-0127- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0127 No score
M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto.
- Record
DEBIAN-CVE-2009-0127- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
m2cryptoDebian:12 |
All versions, plus listed versions 0.38.0-40.38.0-4.10.40.1-10.40.1-20.40.1-3 Show 12 moreShow less0.40.1-40.41.0+ds-10.41.0+ds-20.41.0+ds-30.41.0-10.42.0-10.42.0-20.42.0-2.10.42.0-30.46.2-10.46.2-20.46.2-3 |
None known |
m2cryptoDebian:13 |
All versions, plus listed versions 0.42.0-30.46.2-10.46.2-20.46.2-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0127 is a medium vulnerability (CVSS 5.0) in Heikkitoivonen M2crypto, published January 15, 2009. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile.