Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
OpenSSL 授权问题漏洞
Vulnerability Description
OpenSSL是Openssl团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL存在授权问题漏洞，该漏洞源于CMS_verify()函数在处理畸形的签名属性时没有正确地处理出错情况，可能导致应用将畸形的签名属性集处理为有效，绕过之后的检查。成功利用这个漏洞要求OpenSSL启用了CMS且访问了之前生成的无效签名。
CVSS Information
N/A
Vulnerability Type
N/A