Every CVE Search/ Get API key

CVE-2009-3245

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1...

10.0 HighFix available

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Exploit likelihood

5.78%Up 1.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Record
CVE-2009-3245
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Record
CVE-2009-3245
Updated
2026-11-02
EUVDEUVD-2009-3228 No score

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Record
EUVD-2009-3228
Updated
2026-11-03
GitHub AdvisoriesGHSA-c5qh-p8w9-vjq7 No score

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1...

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Record
GHSA-c5qh-p8w9-vjq7
Weakness
CWE-20
Updated
2026-11-02
OSV No score

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Record
CVE-2009-3245
Updated
2026-11-02
OSVDEBIAN-CVE-2009-3245 No score

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Record
DEBIAN-CVE-2009-3245
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 0.9.8m-1
0.9.8m-1
openssl
Debian:13
 before 0.9.8m-1
0.9.8m-1
openssl
Debian:14
 before 0.9.8m-1
0.9.8m-1
openssl
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
openssl-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
openssl-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
openssl
Red Hat:enterprise_linux:5::client
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
openssl-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
openssl-perl
Red Hat:enterprise_linux:5::client
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
openssl
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
Show 37 moreShow less
Affected packages
PackageAffectedFixed
openssl-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
openssl-devel
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
openssl-perl
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-12.el5_4.6
0:0.9.8e-12.el5_4.6
openssl096b
Red Hat:enterprise_linux:3::as
 before 0:0.9.6b-16.50
0:0.9.6b-16.50
openssl096b-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:0.9.6b-16.50
0:0.9.6b-16.50
openssl096b
Red Hat:enterprise_linux:3::desktop
 before 0:0.9.6b-16.50
0:0.9.6b-16.50
openssl096b-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:0.9.6b-16.50
0:0.9.6b-16.50
openssl096b
Red Hat:enterprise_linux:3::es
 before 0:0.9.6b-16.50
0:0.9.6b-16.50
openssl096b-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:0.9.6b-16.50
0:0.9.6b-16.50
openssl096b
Red Hat:enterprise_linux:3::ws
 before 0:0.9.6b-16.50
0:0.9.6b-16.50
openssl096b-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:0.9.6b-16.50
0:0.9.6b-16.50
openssl096b
Red Hat:enterprise_linux:4::as
 before 0:0.9.6b-22.46.el4_8.1
0:0.9.6b-22.46.el4_8.1
openssl096b-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:0.9.6b-22.46.el4_8.1
0:0.9.6b-22.46.el4_8.1
openssl096b
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.6b-22.46.el4_8.1
0:0.9.6b-22.46.el4_8.1
openssl096b-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.6b-22.46.el4_8.1
0:0.9.6b-22.46.el4_8.1
openssl096b
Red Hat:enterprise_linux:4::es
 before 0:0.9.6b-22.46.el4_8.1
0:0.9.6b-22.46.el4_8.1
openssl096b-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:0.9.6b-22.46.el4_8.1
0:0.9.6b-22.46.el4_8.1
openssl096b
Red Hat:enterprise_linux:4::ws
 before 0:0.9.6b-22.46.el4_8.1
0:0.9.6b-22.46.el4_8.1
openssl096b-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:0.9.6b-22.46.el4_8.1
0:0.9.6b-22.46.el4_8.1
rhev-hypervisor
Red Hat:enterprise_linux:5::hypervisor
 before 0:5.4-2.1.12.1.el5_4rhev2_1
0:5.4-2.1.12.1.el5_4rhev2_1
rhev-hypervisor-pxe
Red Hat:enterprise_linux:5::hypervisor
 before 0:5.4-2.1.12.1.el5_4rhev2_1
0:5.4-2.1.12.1.el5_4rhev2_1
openssl
Red Hat:enterprise_linux:4::as
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-devel
Red Hat:enterprise_linux:4::as
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-perl
Red Hat:enterprise_linux:4::as
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-devel
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-perl
Red Hat:enterprise_linux:4::desktop
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl
Red Hat:enterprise_linux:4::es
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-devel
Red Hat:enterprise_linux:4::es
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-perl
Red Hat:enterprise_linux:4::es
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl
Red Hat:enterprise_linux:4::ws
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-devel
Red Hat:enterprise_linux:4::ws
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6
openssl-perl
Red Hat:enterprise_linux:4::ws
 before 0:0.9.7a-43.17.el4_8.6
0:0.9.7a-43.17.el4_8.6

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-3245 is a high vulnerability (CVSS 10.0) in Openssl, published March 5, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.78%, the 93rd percentile. Fixed in openssl 0.9.8m-1.

References

Show 63 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open