CVE-2009-0050: Entrouvert Lasso

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

Affected products

• Entrouvert Lasso: up to and including 2.2.1-0; version 1.9.9.0 only; version 2.0.0-1 only

Published 2009-01-07. Last modified 2026-06-16.