CVE-2009-0130
** DISPUTED ** lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value...
lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid.
Exploit likelihood
What each source reports
CVE List
lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid.
- Record
CVE-2009-0130- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
EUVDEUVD-2009-0139
lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid.
- Record
EUVD-2009-0139- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-74cx-pw34-jqwr
** DISPUTED ** lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value...
** DISPUTED ** lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid."
- Record
GHSA-74cx-pw34-jqwr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid.
- Record
CVE-2009-0130- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0130
lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid.
- Record
DEBIAN-CVE-2009-0130- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV No score
lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid.
- Record
CVE-2009-0130- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
erlangDebian:12 |
All versions, plus listed versions 1:25.2.3+dfsg-11:25.2.3+dfsg-1+deb12u11:25.2.3+dfsg-1+deb12u21:25.2.3+dfsg-1+deb12u31:25.2.3+dfsg-1+deb12u4 Show 45 moreShow less1:25.3.2.10+dfsg-11:25.3.2.10+dfsg-21:25.3.2.11+dfsg-11:25.3.2.12+dfsg-11:25.3.2.12+dfsg-21:25.3.2.12+dfsg-31:25.3.2.8+dfsg-11:26.0+dfsg-11:26.0.1+dfsg-11:26.0.2+dfsg-11:26.0~rc2+dfsg-11:26.0~rc3+dfsg-11:26.1.2+dfsg-11:26.2.1+dfsg-11:26.2.4+dfsg-11:27.0+dfsg-11:27.0.1+dfsg-11:27.0.1+dfsg-21:27.0.1+dfsg-31:27.0~rc3+dfsg-11:27.0~rc3+dfsg-21:27.0~rc3+dfsg-31:27.0~rc3+dfsg-41:27.1.2+dfsg-11:27.2+dfsg-11:27.2+dfsg-21:27.2+dfsg-3~exp11:27.2.1+dfsg-11:27.2.1+dfsg-21:27.2.2+dfsg-11:27.2.3+dfsg-11:27.2.4+dfsg-11:27.3+dfsg-11:27.3.1+dfsg-11:27.3.2+dfsg-11:27.3.3+dfsg-11:27.3.4+dfsg-11:27.3.4.1+dfsg-11:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-31:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-6 |
None known |
erlangDebian:13 |
All versions, plus listed versions 1:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1+deb13u11:27.3.4.1+dfsg-1+deb13u21:27.3.4.1+dfsg-1+deb13u31:27.3.4.1+dfsg-1+deb13u4 Show 37 moreShow less1:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-31:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-61:27.3.4.11+dfsg-71:27.3.4.12+dfsg-11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.8+dfsg-11:27.3.4.9+dfsg-11:28.0+dfsg-11:28.0.1+dfsg-11:28.0.2+dfsg-11:28.0.4+dfsg-11:28.1.1+dfsg-11:28.2+dfsg-11:28.3+dfsg-11:28.3.1+dfsg-11:29.0+dfsg-11:29.0+dfsg-21:29.0.1+dfsg-11:29.0.2+dfsg-11:29.0.3+dfsg-11:29.0.4+dfsg-11:29.0.6+dfsg-11:29.0~rc1+dfsg-11:29.0~rc1+dfsg-21:29.0~rc2+dfsg-11:29.0~rc3+dfsg-11:29.0~rc3+dfsg-21:29.0~rc3+dfsg-31:29.0~rc3+dfsg-41:29.1.1+dfsg-1 |
None known |
erlangDebian:14 |
All versions, plus listed versions 1:27.3.4.1+dfsg-11:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-3 Show 33 moreShow less1:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-61:27.3.4.11+dfsg-71:27.3.4.12+dfsg-11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.8+dfsg-11:27.3.4.9+dfsg-11:28.0+dfsg-11:28.0.1+dfsg-11:28.0.2+dfsg-11:28.0.4+dfsg-11:28.1.1+dfsg-11:28.2+dfsg-11:28.3+dfsg-11:28.3.1+dfsg-11:29.0+dfsg-11:29.0+dfsg-21:29.0.1+dfsg-11:29.0.2+dfsg-11:29.0.3+dfsg-11:29.0.4+dfsg-11:29.0.6+dfsg-11:29.0~rc1+dfsg-11:29.0~rc1+dfsg-21:29.0~rc2+dfsg-11:29.0~rc3+dfsg-11:29.0~rc3+dfsg-21:29.0~rc3+dfsg-31:29.0~rc3+dfsg-41:29.1.1+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0130 is a medium vulnerability (CVSS 5.0) in Erlang, published January 15, 2009. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile.
References
Left out here: 30 versions. The JSON record has them.