The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | openssl | < 3.0.11-1~deb12u2 | openssl_3.0.11-1~deb12u2_all.deb |
Debian | 11 | all | openssl | < 1.1.1w-0+deb11u1 | openssl_1.1.1w-0+deb11u1_all.deb |
Debian | 10 | all | openssl | < 1.1.1n-0+deb10u3 | openssl_1.1.1n-0+deb10u3_all.deb |
Debian | 999 | all | openssl | < 3.2.1-3 | openssl_3.2.1-3_all.deb |
Debian | 13 | all | openssl | < 3.2.1-3 | openssl_3.2.1-3_all.deb |