CVE-2009-0127

M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto.

• CWE-287

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511515Third Party Advisory
• http://openwall.com/lists/oss-security/2009/01/12/4Mailing List
• https://bugzilla.redhat.com/show_bug.cgi?id=479676Exploit, Issue Tracking
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511515Third Party Advisory
• http://openwall.com/lists/oss-security/2009/01/12/4Mailing List
• https://bugzilla.redhat.com/show_bug.cgi?id=479676Exploit, Issue Tracking

Published

Jan 15, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0121SQL injection vulnerability in frontpage.php in Goople CMS 1…
• CVE-2009-0122hplip.postinst in HP Linux Imaging and Printing (HPLIP) 2.7.…
• CVE-2009-0123Unspecified vulnerability in Apple Safari on Mac OS X 10.5 a…
• CVE-2009-0124The tqsl_verifyDataBlock function in openssl_cert.cpp in Ame…
• CVE-2009-0125NOTE: this issue has been disputed by the upstream vendor. n…
• CVE-2009-0126The decrypt_public function in lib/crypt.cpp in the client i…
• CVE-2009-0128plugins/crypto/openssl/crypto_openssl.c in Simple Linux Util…
• CVE-2009-0129libcrypt-openssl-dsa-perl does not properly check the return…
• CVE-2009-0130lib/crypto/c_src/crypto_drv.c in erlang does not properly ch…7.5
• CVE-2009-0131The UFS implementation in the kernel in Sun OpenSolaris snv_…
• CVE-2009-0132Integer overflow in the aio_suspend function in Sun Solaris …
• CVE-2009-0133Buffer overflow in Microsoft HTML Help Workshop 4.74 and ear…