// For flags

CVE-2009-4028

mysql: client SSL certificate verification flaw

Severity Score

6.8
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

La función vio_verify_callback en vio_verify_callback de MySQL v5.0.x anteriores a v5.0.88 y v5.1.x anteriores a v5.1.41, cuando utiliza OpenSSL, acepta un valor cero para la profundidad de los certificados X.509, permitiendo a atacantes de hombre en medio (man-in-the-middle) suplantar servidores MySQL de su elección basados en SSL mediante un certificado creado específicamente, como se ha demostrado por un certificado presentado por un servidor vinculado con la biblioteca yaSSL.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
Attack Vector
Adjacent
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-11-20 CVE Reserved
  • 2009-11-30 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
<= 5.0.87
Search vendor "Mysql" for product "Mysql" and version " <= 5.0.87"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.0
Search vendor "Mysql" for product "Mysql" and version "5.0.0"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.1
Search vendor "Mysql" for product "Mysql" and version "5.0.1"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.2
Search vendor "Mysql" for product "Mysql" and version "5.0.2"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.3
Search vendor "Mysql" for product "Mysql" and version "5.0.3"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.4
Search vendor "Mysql" for product "Mysql" and version "5.0.4"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.5
Search vendor "Mysql" for product "Mysql" and version "5.0.5"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.5.0.21
Search vendor "Mysql" for product "Mysql" and version "5.0.5.0.21"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.10
Search vendor "Mysql" for product "Mysql" and version "5.0.10"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.15
Search vendor "Mysql" for product "Mysql" and version "5.0.15"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.16
Search vendor "Mysql" for product "Mysql" and version "5.0.16"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.17
Search vendor "Mysql" for product "Mysql" and version "5.0.17"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.20
Search vendor "Mysql" for product "Mysql" and version "5.0.20"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.22.1.0.1
Search vendor "Mysql" for product "Mysql" and version "5.0.22.1.0.1"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.24
Search vendor "Mysql" for product "Mysql" and version "5.0.24"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.30
Search vendor "Mysql" for product "Mysql" and version "5.0.30"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.36
Search vendor "Mysql" for product "Mysql" and version "5.0.36"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.44
Search vendor "Mysql" for product "Mysql" and version "5.0.44"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.54
Search vendor "Mysql" for product "Mysql" and version "5.0.54"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.56
Search vendor "Mysql" for product "Mysql" and version "5.0.56"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.60
Search vendor "Mysql" for product "Mysql" and version "5.0.60"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.66
Search vendor "Mysql" for product "Mysql" and version "5.0.66"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.82
Search vendor "Mysql" for product "Mysql" and version "5.0.82"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.0.84
Search vendor "Mysql" for product "Mysql" and version "5.0.84"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.1.5
Search vendor "Mysql" for product "Mysql" and version "5.1.5"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.1.23
Search vendor "Mysql" for product "Mysql" and version "5.1.23"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.1.31
Search vendor "Mysql" for product "Mysql" and version "5.1.31"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.1.32
Search vendor "Mysql" for product "Mysql" and version "5.1.32"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.1.34
Search vendor "Mysql" for product "Mysql" and version "5.1.34"
-
Affected
Mysql
Search vendor "Mysql"
Mysql
Search vendor "Mysql" for product "Mysql"
5.1.37
Search vendor "Mysql" for product "Mysql" and version "5.1.37"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.0
Search vendor "Oracle" for product "Mysql" and version "5.0.0"
alpha
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.3
Search vendor "Oracle" for product "Mysql" and version "5.0.3"
beta
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.6
Search vendor "Oracle" for product "Mysql" and version "5.0.6"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.7
Search vendor "Oracle" for product "Mysql" and version "5.0.7"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.8
Search vendor "Oracle" for product "Mysql" and version "5.0.8"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.11
Search vendor "Oracle" for product "Mysql" and version "5.0.11"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.12
Search vendor "Oracle" for product "Mysql" and version "5.0.12"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.13
Search vendor "Oracle" for product "Mysql" and version "5.0.13"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.14
Search vendor "Oracle" for product "Mysql" and version "5.0.14"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.18
Search vendor "Oracle" for product "Mysql" and version "5.0.18"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.19
Search vendor "Oracle" for product "Mysql" and version "5.0.19"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.21
Search vendor "Oracle" for product "Mysql" and version "5.0.21"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.22
Search vendor "Oracle" for product "Mysql" and version "5.0.22"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.23
Search vendor "Oracle" for product "Mysql" and version "5.0.23"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.25
Search vendor "Oracle" for product "Mysql" and version "5.0.25"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.26
Search vendor "Oracle" for product "Mysql" and version "5.0.26"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.27
Search vendor "Oracle" for product "Mysql" and version "5.0.27"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.30
Search vendor "Oracle" for product "Mysql" and version "5.0.30"
sp1
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.32
Search vendor "Oracle" for product "Mysql" and version "5.0.32"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.33
Search vendor "Oracle" for product "Mysql" and version "5.0.33"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.37
Search vendor "Oracle" for product "Mysql" and version "5.0.37"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.38
Search vendor "Oracle" for product "Mysql" and version "5.0.38"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.41
Search vendor "Oracle" for product "Mysql" and version "5.0.41"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.42
Search vendor "Oracle" for product "Mysql" and version "5.0.42"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.45
Search vendor "Oracle" for product "Mysql" and version "5.0.45"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.50
Search vendor "Oracle" for product "Mysql" and version "5.0.50"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.51
Search vendor "Oracle" for product "Mysql" and version "5.0.51"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.52
Search vendor "Oracle" for product "Mysql" and version "5.0.52"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.75
Search vendor "Oracle" for product "Mysql" and version "5.0.75"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.77
Search vendor "Oracle" for product "Mysql" and version "5.0.77"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.81
Search vendor "Oracle" for product "Mysql" and version "5.0.81"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.83
Search vendor "Oracle" for product "Mysql" and version "5.0.83"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.85
Search vendor "Oracle" for product "Mysql" and version "5.0.85"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.0.86
Search vendor "Oracle" for product "Mysql" and version "5.0.86"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1
Search vendor "Oracle" for product "Mysql" and version "5.1"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.1
Search vendor "Oracle" for product "Mysql" and version "5.1.1"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.2
Search vendor "Oracle" for product "Mysql" and version "5.1.2"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.3
Search vendor "Oracle" for product "Mysql" and version "5.1.3"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.4
Search vendor "Oracle" for product "Mysql" and version "5.1.4"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.6
Search vendor "Oracle" for product "Mysql" and version "5.1.6"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.7
Search vendor "Oracle" for product "Mysql" and version "5.1.7"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.8
Search vendor "Oracle" for product "Mysql" and version "5.1.8"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.9
Search vendor "Oracle" for product "Mysql" and version "5.1.9"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.10
Search vendor "Oracle" for product "Mysql" and version "5.1.10"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.11
Search vendor "Oracle" for product "Mysql" and version "5.1.11"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.12
Search vendor "Oracle" for product "Mysql" and version "5.1.12"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.13
Search vendor "Oracle" for product "Mysql" and version "5.1.13"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.14
Search vendor "Oracle" for product "Mysql" and version "5.1.14"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.15
Search vendor "Oracle" for product "Mysql" and version "5.1.15"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.16
Search vendor "Oracle" for product "Mysql" and version "5.1.16"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.17
Search vendor "Oracle" for product "Mysql" and version "5.1.17"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.18
Search vendor "Oracle" for product "Mysql" and version "5.1.18"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.19
Search vendor "Oracle" for product "Mysql" and version "5.1.19"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.20
Search vendor "Oracle" for product "Mysql" and version "5.1.20"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.21
Search vendor "Oracle" for product "Mysql" and version "5.1.21"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.22
Search vendor "Oracle" for product "Mysql" and version "5.1.22"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.23
Search vendor "Oracle" for product "Mysql" and version "5.1.23"
a
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.24
Search vendor "Oracle" for product "Mysql" and version "5.1.24"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.25
Search vendor "Oracle" for product "Mysql" and version "5.1.25"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.26
Search vendor "Oracle" for product "Mysql" and version "5.1.26"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.27
Search vendor "Oracle" for product "Mysql" and version "5.1.27"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.28
Search vendor "Oracle" for product "Mysql" and version "5.1.28"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.29
Search vendor "Oracle" for product "Mysql" and version "5.1.29"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.30
Search vendor "Oracle" for product "Mysql" and version "5.1.30"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.31
Search vendor "Oracle" for product "Mysql" and version "5.1.31"
sp1
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.33
Search vendor "Oracle" for product "Mysql" and version "5.1.33"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.34
Search vendor "Oracle" for product "Mysql" and version "5.1.34"
sp1
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.35
Search vendor "Oracle" for product "Mysql" and version "5.1.35"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.36
Search vendor "Oracle" for product "Mysql" and version "5.1.36"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.37
Search vendor "Oracle" for product "Mysql" and version "5.1.37"
sp1
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.38
Search vendor "Oracle" for product "Mysql" and version "5.1.38"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.39
Search vendor "Oracle" for product "Mysql" and version "5.1.39"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.40
Search vendor "Oracle" for product "Mysql" and version "5.1.40"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
5.1.40
Search vendor "Oracle" for product "Mysql" and version "5.1.40"
sp1
Affected