crypto/x509/x509_vfy.c in OpenSSL 1.0.x prior to 1.0.0e does not initialize certain structure members, which makes it easier for remote malicious users to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
openssl openssl 1.0.0 |
||
openssl openssl 1.0.0b |
||
openssl openssl 1.0.0d |
||
openssl openssl 1.0.0a |
||
openssl openssl 1.0.0c |