CVE-2008-0555: apache-ssl Improper Input Validation
Vulnerability summary
CVE-2008-0555 is a high (CVSS 7.5) Improper Input Validation vulnerability in apache-ssl. EPSS estimates a 1.87% chance of exploitation in the next 30 days, higher than 79% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 04-04-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.87%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.87% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (cynops.de)
Maturity: unknown
Exploit Reference (apache-ssl.org)
Maturity: unknown
Exploit Reference (klink.name)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Apache-ssl1 product
- apache-ssl1.3.34_1.57
1 vendor · 1 product