CVE-2009-4028: The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for…

PriorityP430medium6.8CVSS 2.0

AVNACMAuNCPIPAP

EPSS

1.77%

75.7th percentile

The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

Affected

103 ranges· showing 25

Vendor	Product	Version range	Fixed in
mysql	mysql	<= 5.0.87	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—
mysql	mysql	—	—

CVSS provenance

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

vendor_redhat6.8MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.