CVE-2008-5077
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal...
5.8 MediumFix available
CVE-2008-5077 is a medium vulnerability (CVSS 5.8) in Openssl, published January 7, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.15%, the 92nd percentile. Fixed in openssl 0.9.8g-15.
- Severity
- 5.8 MediumCVSS 2.0, NVD
- Exploit chance
- 5.15%EPSS, 92nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.9.8g-15openssl +83 more
Description
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
Exploit likelihood
5.15%Down 2.4 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 | before 0.9.8g-15 | 0.9.8g-15 |
opensslDebian:13 | before 0.9.8g-15 | 0.9.8g-15 |
opensslDebian:14 | before 0.9.8g-15 | 0.9.8g-15 |
openssl097Debian:4.0 | before 0.9.7k-3.1etch2, plus listed versions 0.9.7k-3.10.9.7k-3.1etch1 | 0.9.7k-3.1etch2 |
opensslDebian:4.0 | before 0.9.8c-4etch4, plus listed versions 0.9.8c-40.9.8c-4etch10.9.8c-4etch20.9.8c-4etch30.9.8c-4etch3+m68k1 | 0.9.8c-4etch4 |
opensslRed Hat:enterprise_linux:2.1::as | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl-develRed Hat:enterprise_linux:2.1::as | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl-perlRed Hat:enterprise_linux:2.1::as | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl095aRed Hat:enterprise_linux:2.1::as | before 0:0.9.5a-34 | 0:0.9.5a-34 |
openssl096Red Hat:enterprise_linux:2.1::as | before 0:0.9.6-34 | 0:0.9.6-34 |
Show 74 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensslRed Hat:enterprise_linux:2.1::aw | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl-develRed Hat:enterprise_linux:2.1::aw | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl-perlRed Hat:enterprise_linux:2.1::aw | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl095aRed Hat:enterprise_linux:2.1::aw | before 0:0.9.5a-34 | 0:0.9.5a-34 |
openssl096Red Hat:enterprise_linux:2.1::aw | before 0:0.9.6-34 | 0:0.9.6-34 |
opensslRed Hat:enterprise_linux:2.1::es | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl-develRed Hat:enterprise_linux:2.1::es | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl-perlRed Hat:enterprise_linux:2.1::es | before 0:0.9.6b-49 | 0:0.9.6b-49 |
opensslRed Hat:enterprise_linux:2.1::ws | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl-develRed Hat:enterprise_linux:2.1::ws | before 0:0.9.6b-49 | 0:0.9.6b-49 |
openssl-perlRed Hat:enterprise_linux:2.1::ws | before 0:0.9.6b-49 | 0:0.9.6b-49 |
opensslRed Hat:enterprise_linux:3::as | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-debuginfoRed Hat:enterprise_linux:3::as | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-develRed Hat:enterprise_linux:3::as | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-perlRed Hat:enterprise_linux:3::as | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl096bRed Hat:enterprise_linux:3::as | before 0:0.9.6b-16.49 | 0:0.9.6b-16.49 |
openssl096b-debuginfoRed Hat:enterprise_linux:3::as | before 0:0.9.6b-16.49 | 0:0.9.6b-16.49 |
opensslRed Hat:enterprise_linux:3::desktop | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-debuginfoRed Hat:enterprise_linux:3::desktop | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-develRed Hat:enterprise_linux:3::desktop | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-perlRed Hat:enterprise_linux:3::desktop | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl096bRed Hat:enterprise_linux:3::desktop | before 0:0.9.6b-16.49 | 0:0.9.6b-16.49 |
openssl096b-debuginfoRed Hat:enterprise_linux:3::desktop | before 0:0.9.6b-16.49 | 0:0.9.6b-16.49 |
opensslRed Hat:enterprise_linux:3::es | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-debuginfoRed Hat:enterprise_linux:3::es | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-develRed Hat:enterprise_linux:3::es | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-perlRed Hat:enterprise_linux:3::es | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl096bRed Hat:enterprise_linux:3::es | before 0:0.9.6b-16.49 | 0:0.9.6b-16.49 |
openssl096b-debuginfoRed Hat:enterprise_linux:3::es | before 0:0.9.6b-16.49 | 0:0.9.6b-16.49 |
opensslRed Hat:enterprise_linux:3::ws | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-debuginfoRed Hat:enterprise_linux:3::ws | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-develRed Hat:enterprise_linux:3::ws | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl-perlRed Hat:enterprise_linux:3::ws | before 0:0.9.7a-33.25 | 0:0.9.7a-33.25 |
openssl096bRed Hat:enterprise_linux:3::ws | before 0:0.9.6b-16.49 | 0:0.9.6b-16.49 |
openssl096b-debuginfoRed Hat:enterprise_linux:3::ws | before 0:0.9.6b-16.49 | 0:0.9.6b-16.49 |
opensslRed Hat:enterprise_linux:4::as | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-debuginfoRed Hat:enterprise_linux:4::as | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-develRed Hat:enterprise_linux:4::as | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-perlRed Hat:enterprise_linux:4::as | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl096bRed Hat:enterprise_linux:4::as | before 0:0.9.6b-22.46.el4_7 | 0:0.9.6b-22.46.el4_7 |
openssl096b-debuginfoRed Hat:enterprise_linux:4::as | before 0:0.9.6b-22.46.el4_7 | 0:0.9.6b-22.46.el4_7 |
opensslRed Hat:enterprise_linux:4::desktop | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-debuginfoRed Hat:enterprise_linux:4::desktop | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-develRed Hat:enterprise_linux:4::desktop | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-perlRed Hat:enterprise_linux:4::desktop | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl096bRed Hat:enterprise_linux:4::desktop | before 0:0.9.6b-22.46.el4_7 | 0:0.9.6b-22.46.el4_7 |
openssl096b-debuginfoRed Hat:enterprise_linux:4::desktop | before 0:0.9.6b-22.46.el4_7 | 0:0.9.6b-22.46.el4_7 |
opensslRed Hat:enterprise_linux:4::es | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-debuginfoRed Hat:enterprise_linux:4::es | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-develRed Hat:enterprise_linux:4::es | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-perlRed Hat:enterprise_linux:4::es | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl096bRed Hat:enterprise_linux:4::es | before 0:0.9.6b-22.46.el4_7 | 0:0.9.6b-22.46.el4_7 |
openssl096b-debuginfoRed Hat:enterprise_linux:4::es | before 0:0.9.6b-22.46.el4_7 | 0:0.9.6b-22.46.el4_7 |
opensslRed Hat:enterprise_linux:4::ws | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-debuginfoRed Hat:enterprise_linux:4::ws | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-develRed Hat:enterprise_linux:4::ws | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl-perlRed Hat:enterprise_linux:4::ws | before 0:0.9.7a-43.17.el4_7.2 | 0:0.9.7a-43.17.el4_7.2 |
openssl096bRed Hat:enterprise_linux:4::ws | before 0:0.9.6b-22.46.el4_7 | 0:0.9.6b-22.46.el4_7 |
openssl096b-debuginfoRed Hat:enterprise_linux:4::ws | before 0:0.9.6b-22.46.el4_7 | 0:0.9.6b-22.46.el4_7 |
opensslRed Hat:enterprise_linux:5::client_workstation | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
openssl-debuginfoRed Hat:enterprise_linux:5::client_workstation | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
openssl-develRed Hat:enterprise_linux:5::client_workstation | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
opensslRed Hat:enterprise_linux:5::client | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
openssl-debuginfoRed Hat:enterprise_linux:5::client | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
openssl-perlRed Hat:enterprise_linux:5::client | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
openssl097aRed Hat:enterprise_linux:5::client | before 0:0.9.7a-9.el5_2.1 | 0:0.9.7a-9.el5_2.1 |
openssl097a-debuginfoRed Hat:enterprise_linux:5::client | before 0:0.9.7a-9.el5_2.1 | 0:0.9.7a-9.el5_2.1 |
opensslRed Hat:enterprise_linux:5::server | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
openssl-debuginfoRed Hat:enterprise_linux:5::server | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
openssl-develRed Hat:enterprise_linux:5::server | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
openssl-perlRed Hat:enterprise_linux:5::server | before 0:0.9.8b-10.el5_2.1 | 0:0.9.8b-10.el5_2.1 |
openssl097aRed Hat:enterprise_linux:5::server | before 0:0.9.7a-9.el5_2.1 | 0:0.9.7a-9.el5_2.1 |
openssl097a-debuginfoRed Hat:enterprise_linux:5::server | before 0:0.9.7a-9.el5_2.1 | 0:0.9.7a-9.el5_2.1 |
openssl-1_1openSUSE:Tumbleweed From an advisory covering 136 CVEs | before 1.1.1l-1.2 | 1.1.1l-1.2 |
What each source reports
NVD Score used
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
- Record
CVE-2008-5077- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
- Record
CVE-2008-5077- Updated
- 2026-11-02
EUVDEUVD-2008-5056No score
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
- Record
EUVD-2008-5056- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5fwv-px3v-6qxvNo score
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal...
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
- Record
GHSA-5fwv-px3v-6qxv- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVNo score
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
- Record
CVE-2008-5077- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-5077No score
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
- Record
DEBIAN-CVE-2008-5077- Updated
- 2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2024:10271-1No score
libopenssl-devel-1.0.2j-2.2 on GA media
These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10271-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10529-1No score
libopenssl1_0_0-steam-1.0.2h-4.1 on GA media
These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10529-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10658-1No score
boinc-client-7.18.0-1.2 on GA media
These are all security issues fixed in the boinc-client-7.18.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10658-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11127-1No score
libopenssl-1_1-devel-1.1.1l-1.2 on GA media
These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11127-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
marc.info?l=bugtraq&m=123859864430555&w=2
vmware.com/security/advisories/VMSA-2009-0004.html
lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html
support.apple.com/kb/HT3549
securityfocus.com/archive/1/499827/100/0/threaded
sunsolve.sun.com/search/document.do?assetkey=1-66-250826-1
Show 194 moreShow less
openssl.org/news/secadv_20090107.txt
vupen.com/english/advisories/2009/0558
securitytracker.com/id?1021523
security.gentoo.org/glsa/glsa-200902-02.xml
secunia.com/advisories/35074
support.avaya.com/elmodocs2/security/ASA-2009-038.htm
lists.apple.com/archives/security-announce/2009/May/msg00002.html
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.544796
ocert.org/advisories/ocert-2008-016.html
us-cert.gov/cas/techalerts/TA09-133A.html
support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=837653
redhat.com/support/errata/RHSA-2009-0004.html
usn.ubuntu.com/704-1
voodoo-circle.sourceforge.net/sa/sa-20090123-01.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6380
nvd.nist.gov/vuln/detail/CVE-2008-5077
github.com/advisories/GHSA-5fwv-px3v-6qxv
security-tracker.debian.org/tracker/CVE-2008-5077
access.redhat.com/errata/RHSA-2009:0004
bugzilla.redhat.com/show_bug.cgi?id=476671
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0004.json
cve.org/CVERecord?id=CVE-2008-5077
suse.com/support/update/announcement/-2022-445/suse-fu-20220445-1
bugzilla.suse.com/1000080
This page doesn't list everything
Left out here: 532 references. The JSON record has them.