Description
The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Advisories 1
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- SSRT090059 vendor-advisory
- ADV-2009-0850 vdb-entry
- ADV-2009-1175 vdb-entry
- 42724 third-party-advisory
- openssl-cmsverify-security-bypass(49432) vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847
- 34666 third-party-advisory
- ADV-2009-1020 vdb-entry
- 35729 third-party-advisory
- 35380 third-party-advisory
- HPSBOV02540 vendor-advisory
- APPLE-SA-2009-09-10-2 vendor-advisory
- 35065 third-party-advisory
- http://www.php.net/archive/2009.php#id2009-04-08-1
- 34411 third-party-advisory
- 52865 vdb-entry
- SUSE-SR:2009:010 vendor-advisory
- http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html
- http://support.apple.com/kb/HT3865
- http://www.openssl.org/news/secadv_20090325.txt
- ADV-2009-1548 vdb-entry
- 36701 third-party-advisory
- https://kb.bluecoat.com/index?page=content&id=SA50
- 34460 third-party-advisory
- 34256 vdb-entry
- 1021907 vdb-entry
- 42733 third-party-advisory