Upstream information
Description
Belgian eID middleware (eidlib) 2.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.Novell/SUSE information
Novell Bugzilla entry: 468866 SUSE Security Advisories:- SUSE-SR:2009:005, published Mon, 02 Mar 2009 13:00:00 +0000
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| openSUSE 10.3 |
| |
| SUSE Linux Enterprise Desktop 10 SP2 for AMD64 and Intel EM64T SUSE Linux Enterprise Desktop 10 SP2 for x86 |
| sled10-sp2.x86 sle10-sp2-sdk.x86 sled10-sp2.x86-64 sle10-sp2-sdk.x86-64 sle10-sp2-sdk.s390x sle10-sp2-sdk.ppc sle10-sp2-sdk.ia64 ZYPP Patch Nr: 6006 |