← Back

CVE-2009-0047

nvd nist
Published: Jan 7, 2009Modified: Apr 23, 2026

JSON object

Loading...
5.0
Vector
AV:N/AC:L/Au:N/C:P/I:N/A:N
Exploitability: 10.0 / Impact: 2.9
Source: NVD

Description

Gale 0.99 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

Affected (22)

Products: Gale: Gale
Gale
1 product
Gale
Configuration A
22 vulnerable
Vulnerable SoftwareAffected Versions
Gale
Gale
Up to 0.99
Gale
Version 0.15
Gale
Version 0.15b
Gale
Version 0.15c
Gale
Version 0.16
Gale
Version 0.16a
Gale
Version 0.17
Gale
Version 0.17a
Gale
Version 0.18
Gale
Version 0.18b
Gale
Version 0.18c
Gale
Version 0.19
Gale
Version 0.19a
Gale
Version 0.19b
Gale
Version 0.20a
Gale
Version 0.21
Gale
Version 0.90a
Gale
Version 0.90b
Gale
Version 0.90c
Gale
Version 0.91
Gale
Version 0.91a
Gale
Version 0.91b

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-310
CWE-310

References (6)

Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.