CVE-2009-0130: High severity Erlang Erlang vulnerability
DISPUTED lib/crypto/csrc/cryptodrv.c in erlang does not properly check the return value from the OpenSSL DSAdoverify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of cryptodrv.c, and thus "this report is invalid."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0130?
CVE-2009-0130 is considered a medium severity vulnerability that could lead to the bypass of certificate chain validation.
How do I fix CVE-2009-0130?
To fix CVE-2009-0130, upgrade to a patched version of Erlang that addresses the vulnerability in the crypto_drv.c file.
What types of attacks can exploit CVE-2009-0130?
CVE-2009-0130 can be exploited by remote attackers to bypass SSL/TLS signature validation using a malformed certificate.
Which software versions are affected by CVE-2009-0130?
CVE-2009-0130 affects versions of Erlang/OTP that utilize the vulnerable crypto_drv.c implementation without proper return value checks.
Is CVE-2009-0130 related to any other vulnerabilities?
Yes, CVE-2009-0130 is similar to CVE-2008-5077 in its nature of allowing certificate validation bypass.