CVE-2008-3323: Red Hat Cygwin

High severity, CVSS 7.6. EPSS: 2.6% chance of exploitation in the next 30 days.

setup.exe before 2.573.2.3 in Cygwin does not properly verify the authenticity of packages, which allows remote Cygwin mirror servers or man-in-the-middle attackers to execute arbitrary code via a package list containing the MD5 checksum of a Trojan horse package.

Affected products

• Red Hat Cygwin: up to and including 1.7

Published 2008-07-28. Last modified 2026-06-16.