CVE-2009-0050: Input Validation
Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0050?
CVE-2009-0050 is considered to have a moderate severity level due to its potential for allowing remote attackers to bypass SSL/TLS certificate validation.
How do I fix CVE-2009-0050?
To fix CVE-2009-0050, upgrade Lasso to version 2.2.2 or later where the vulnerability has been addressed.
What systems are affected by CVE-2009-0050?
CVE-2009-0050 affects Lasso versions 2.2.1 and earlier, including specific versions 1.9.9.0 and 2.0.0-1.
Can CVE-2009-0050 be exploited remotely?
Yes, CVE-2009-0050 can be exploited remotely by attackers through malformed SSL/TLS signatures.
What kind of vulnerability is CVE-2009-0050?
CVE-2009-0050 is a vulnerability related to improper validation of SSL/TLS signatures in the OpenSSL library.