Skip to content

Internet Systems Consortium (ISC) BIND 9.6.0 and earlier...

Moderate severity Unreviewed Published May 2, 2022 to the GitHub Advisory Database • Updated Feb 22, 2024

Package

No package listedSuggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and CVE-2009-0025.

References

Published by the National Vulnerability Database Jan 26, 2009
Published to the GitHub Advisory Database May 2, 2022
Last updated Feb 22, 2024

Severity

Moderate

EPSS score

0.400%
(74th percentile)

CVE ID

CVE-2009-0265

GHSA ID

GHSA-mrwj-9mpp-w94q

Source code

No known source code

Dependabot alerts are not supported on this advisory because it does not have a package from a supported ecosystem with an affected and fixed version.

Learn more about GitHub language support

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.