9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.278 Low
EPSS
Percentile
96.8%
a. Updated OpenSSL package for the Service Console fixes a security issue. OpenSSL 0.9.7a-33.24 and earlier does not properly check the return value from the EVP_VerifyFinal function, which could allow a remote attacker to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-5077 to this issue. The following table lists what action remediates the vulnerability (column 4) if a solution is available.
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2953
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2712
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3432
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4101
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5077
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025