CVE-2009-0590: Debian Linux

Medium severity, CVSS 5.0. EPSS: 6.7% chance of exploitation in the next 30 days.

The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.

Affected products

• Debian Debian Linux: version 4.0 only; version 5.0 only
• OpenSSL OpenSSL: before 0.9.8k (fixed in 0.9.8k)

Published 2009-03-27. Last modified 2026-06-16.