Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0591 to the following vulnerability: Name: CVE-2009-0591 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0591 Assigned: 20090213 Reference: CONFIRM: http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847 Reference: CONFIRM: http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html Reference: CONFIRM: http://www.openssl.org/news/secadv_20090325.txt Reference: BID:34256 Reference: URL: http://www.securityfocus.com/bid/34256 Reference: OSVDB:52865 Reference: URL: http://www.osvdb.org/52865 Reference: SECTRACK:1021907 Reference: URL: http://securitytracker.com/id?1021907 Reference: SECUNIA:34411 Reference: URL: http://secunia.com/advisories/34411 Reference: SECUNIA:34460 Reference: URL: http://secunia.com/advisories/34460 Reference: VUPEN:ADV-2009-0850 Reference: URL: http://www.vupen.com/english/advisories/2009/0850 Reference: XF:openssl-cmsverify-security-bypass(49432) Reference: URL: http://xforce.iss.net/xforce/xfdb/49432 The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.
This issue does not affect Red Hat Enterprise Linux 2.1, 3, 4, or 5.
Current stable Fedora versions (F9 and F10) were not affected too, as they ship openssl 0.9.8g and the affected functionality was only introduced in 0.9.8h. Rawhide/F11 was affected (even though CMS is not enabled in the upstream sources by default, it is enabled explicitly in the Fedora spec file) and has already been updated to the fixed upstream version 0.9.8k.