CVE-2009-0130

Name	CVE-2009-0130
Description	lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	511520

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
erlang (PTS)	jessie, jessie (lts)	1:17.3-dfsg-4+deb8u2	vulnerable
	stretch (security)	1:19.2.1+dfsg-2+deb9u1	vulnerable
	stretch (lts), stretch	1:19.2.1+dfsg-2+really23.3.4.18-0+deb9u2	vulnerable
	buster (security), buster, buster (lts)	1:22.2.7+dfsg-1+deb10u1	vulnerable
	bullseye	1:23.2.6+dfsg-1+deb11u1	vulnerable
	bookworm	1:25.2.3+dfsg-1	vulnerable
	trixie	1:25.3.2.12+dfsg-3	vulnerable
	sid	1:27.1.2+dfsg-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
erlang	source	(unstable)	(unfixed)	unimportant		511520

Notes

the return value is passed to the caller (lib/crypto/src/crypto.erl) which
only return success in case of DSA_do_verify returning 1 and failure otherwise
this is likely to be rejected