CVE-2009-0590
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a...
5.0 MediumFix available
CVE-2009-0590 is a medium vulnerability (CVSS 5.0) in Openssl, published March 27, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.71%, the 94th percentile. Fixed in openssl 0.9.8g-16.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 6.71%EPSS, 94th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.9.8g-16openssl +48 more
Description
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
Exploit likelihood
6.71%Down 0.9 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 | before 0.9.8g-16 | 0.9.8g-16 |
opensslDebian:13 | before 0.9.8g-16 | 0.9.8g-16 |
opensslDebian:14 | before 0.9.8g-16 | 0.9.8g-16 |
openssl097Debian:4.0 | before 0.9.7k-3.1etch3, plus listed versions 0.9.7k-3.10.9.7k-3.1etch10.9.7k-3.1etch2 | 0.9.7k-3.1etch3 |
opensslDebian:4.0 | before 0.9.8c-4etch5, plus listed versions 0.9.8c-40.9.8c-4etch10.9.8c-4etch20.9.8c-4etch30.9.8c-4etch3+m68k10.9.8c-4etch4 | 0.9.8c-4etch5 |
opensslDebian:5.0 | before 0.9.8g-15+lenny1, plus listed versions 0.9.8g-15 | 0.9.8g-15+lenny1 |
opensslRed Hat:enterprise_linux:5::client_workstation From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
openssl-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
openssl-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
opensslRed Hat:enterprise_linux:5::client From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
Show 39 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openssl-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
openssl-perlRed Hat:enterprise_linux:5::client From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
opensslRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
openssl-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
openssl-develRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
openssl-perlRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs | before 0:0.9.8e-12.el5 | 0:0.9.8e-12.el5 |
opensslRed Hat:enterprise_linux:3::as From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-develRed Hat:enterprise_linux:3::as From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-perlRed Hat:enterprise_linux:3::as From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
opensslRed Hat:enterprise_linux:3::desktop From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-develRed Hat:enterprise_linux:3::desktop From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-perlRed Hat:enterprise_linux:3::desktop From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
opensslRed Hat:enterprise_linux:3::es From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-develRed Hat:enterprise_linux:3::es From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-perlRed Hat:enterprise_linux:3::es From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
opensslRed Hat:enterprise_linux:3::ws From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-develRed Hat:enterprise_linux:3::ws From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
openssl-perlRed Hat:enterprise_linux:3::ws From an advisory covering 3 CVEs | before 0:0.9.7a-33.26 | 0:0.9.7a-33.26 |
opensslRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-develRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-perlRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
opensslRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-develRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-perlRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
opensslRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-develRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-perlRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
opensslRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-develRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-perlRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
openssl-1_1openSUSE:Tumbleweed From an advisory covering 136 CVEs | before 1.1.1l-1.2 | 1.1.1l-1.2 |
What each source reports
NVD Score used
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
- Record
CVE-2009-0590- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
- Record
CVE-2009-0590- Updated
- 2026-11-02
EUVDEUVD-2009-0593No score
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
- Record
EUVD-2009-0593- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pvqm-jc37-37p5No score
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a...
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
- Record
GHSA-pvqm-jc37-37p5- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
- Record
CVE-2009-0590- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0590No score
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
- Record
DEBIAN-CVE-2009-0590- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:10271-1No score
libopenssl-devel-1.0.2j-2.2 on GA media
These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10271-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10529-1No score
libopenssl1_0_0-steam-1.0.2h-4.1 on GA media
These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10529-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11127-1No score
libopenssl-1_1-devel-1.1.1l-1.2 on GA media
These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11127-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
marc.info?l=bugtraq&m=124464882609472&w=2
vupen.com/english/advisories/2009/0850
securitytracker.com/id?1021905
secunia.com/advisories/34896
mandriva.com/security/advisories?name=MDVSA-2009:087
Show 194 moreShow less
securityfocus.com/archive/1/502429/100/0/threaded
lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html
wiki.rpath.com/Advisories:rPSA-2009-0057
debian.org/security/2009/dsa-1763
lists.vmware.com/pipermail/security-announce/2010/000082.html
sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847
ubuntu.com/usn/usn-750-1
security.FreeBSD.org/advisories/FreeBSD-SA-09:08.openssl.asc
redhat.com/support/errata/RHSA-2009-1335.html
osvdb.org/52864
lists.apple.com/archives/security-announce/2009/Sep/msg00004.html
lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10198
php.net/archive/2009.php
exchange.xforce.ibmcloud.com/vulnerabilities/49431
sunsolve.sun.com/search/document.do?assetkey=1-26-258048-1
voodoo-circle.sourceforge.net/sa/sa-20090326-01.html
support.apple.com/kb/HT3865
openssl.org/news/secadv_20090325.txt
support.avaya.com/elmodocs2/security/ASA-2009-172.htm
vmware.com/security/advisories/VMSA-2010-0019.html
kb.bluecoat.com/index?page=content&id=SA50
nvd.nist.gov/vuln/detail/CVE-2009-0590
github.com/advisories/GHSA-pvqm-jc37-37p5
security-tracker.debian.org/tracker/CVE-2009-0590
access.redhat.com/errata/RHSA-2009:1335
bugzilla.redhat.com/show_bug.cgi?id=479817
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1335.json
cve.org/CVERecord?id=CVE-2006-7250
kbase.redhat.com/faq/docs/DOC-20491
suse.com/support/update/announcement/-2022-445/suse-fu-20220445-1
bugzilla.suse.com/1000080
This page doesn't list everything
Left out here: 583 references. The JSON record has them.