Servers and applications
CVE-2008-5077 OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
Severity Medium 5.8
Published 7 Jan 2009
Last changed 16 Jun 2026
Added to UpHeron 21 Oct 2026 Exploit chance 5.1% in the next 30 daysHigher than 92% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · No login needed
Attacker can Change some data · Slow it down
CVSS vector AV:N/AC:M/Au:N/C:N/I:P/A:P
Sources NVD Affected software Software Affected versions OpenSSLServers and applications · cpe:a:openssl:openssl Version 0.9.8g Version 0.9.8f Version 0.9.8e Version 0.9.8d All 59 release lines Every version up to 0.9.8h Version 0.9.1c Version 0.9.2b Version 0.9.3 Version 0.9.3a Version 0.9.4 Version 0.9.5a-beta1 Version 0.9.5a-beta2 Version 0.9.5-beta1 Version 0.9.5-beta2 Version 0.9.5 Version 0.9.5a Version 0.9.6a-beta1 Version 0.9.6a-beta2 Version 0.9.6a-beta3 Version 0.9.6-beta1 Version 0.9.6-beta2 Version 0.9.6-beta3 Version 0.9.6 Version 0.9.6a Version 0.9.6b Version 0.9.6c Version 0.9.6d Version 0.9.6e Version 0.9.6f Version 0.9.6g Version 0.9.6h Version 0.9.6i Version 0.9.6j Version 0.9.6k Version 0.9.6l Version 0.9.6m Version 0.9.7-beta1 Version 0.9.7-beta2 Version 0.9.7-beta3 Version 0.9.7-beta4 Version 0.9.7-beta5 Version 0.9.7-beta6 Version 0.9.7 Version 0.9.7a Version 0.9.7b Version 0.9.7c Version 0.9.7d Version 0.9.7e Version 0.9.7f Version 0.9.7g Version 0.9.7h Version 0.9.7i Version 0.9.7j Version 0.9.7k Version 0.9.7l Version 0.9.8 Version 0.9.8a Version 0.9.8b Version 0.9.8c Version 0.9.8d Version 0.9.8e Version 0.9.8f Version 0.9.8g
References NVD https://nvd.nist.gov/vuln/detail/CVE-2008-5077 CVE.org https://www.cve.org/CVERecord?id=CVE-2008-5077