CVE-2009-0591: OpenSSL

Low severity, CVSS 2.6. EPSS: 2.7% chance of exploitation in the next 30 days.

The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.

Affected products

• OpenSSL OpenSSL: version 0.9.8h only; version 0.9.8i only; version 0.9.8j only

Published 2009-03-27. Last modified 2026-06-16.