Erlang DSA Signature Verification Vulnerability Affecting OpenSSL

CVE-2009-0130

What is CVE-2009-0130?

In Erlang, a flaw exists in the library handling cryptographic functions, where the return value from the OpenSSL DSA_do_verify function is not adequately checked. This lack of verification could allow remote attackers to bypass the expected validation process for certificate chains, potentially leading to unauthorized access or the exploitation of secure channels via manipulated SSL/TLS signatures. Although a package maintainer argues that proper checks are in place within the pertinent code, this vulnerability raises significant concerns about the robustness of SSL/TLS implementations in affected versions.

References