| Package | Affected versions | Patched versions |
|---|---|---|
| gale | = 0.15= 0.15b= 0.15c= 0.16= 0.16a= 0.17= 0.17a= 0.18= 0.18b= 0.18c= 0.19= 0.19a= 0.19b= 0.20a= 0.21= 0.90a= 0.90b= 0.90c= 0.91= 0.91a= 0.91b≤ 0.99 |
Gale 0.99 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free