CVE-2009-0591: Low severity OpenSSL OpenSSL vulnerability
The CMSverify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable CMS support (rebuild or configure OpenSSL without CMS or otherwise disable CMS functionality) to avoid use of CMS_verify in vulnerable OpenSSL versions 0.9.8h through 0.9.8j.
OpenSSL (CMS support) CMS enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0591?
CVE-2009-0591 has a moderate severity rating due to its potential to allow repudiation of signatures.
How do I fix CVE-2009-0591?
To fix CVE-2009-0591, it is recommended to upgrade OpenSSL to a version beyond 0.9.8j.
What systems are affected by CVE-2009-0591?
CVE-2009-0591 affects OpenSSL versions 0.9.8h through 0.9.8j that have CMS enabled.
Can CVE-2009-0591 be exploited remotely?
Yes, CVE-2009-0591 can be exploited by remote attackers to repudiate signatures.
What is the impact of CVE-2009-0591?
The impact of CVE-2009-0591 includes the ability for attackers to compromise the integrity of digitally signed data.