CVE-2009-0130: lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_ve...

Security readout for executives and security teams

This CVE alleges Erlang’s crypto driver might accept malformed SSL/TLS DSA signatures because it failed to check an OpenSSL verification result. The public record also says a package maintainer disputed the report as invalid. Treat exposure as uncertain until vendor or package guidance confirms impact in your environment. Potentially relevant only to systems using Erlang crypto or SSL/TLS certificate validation paths involving DSA signatures. The source bundle lists affected vendor, product, and versions as n/a, so exposure cannot be determined from the provided evidence alone. Do not treat this as a confirmed emergency based on the supplied sources. Track it as an uncertain legacy finding, verify actual Erlang exposure, and rely on vendor package guidance before assigning remediation urgency. Mitigation focus: Check current Erlang/OTP and distribution vendor advisories for CVE-2009-0130 status.; Prioritize supported Erlang/OTP packages from trusted distribution repositories.; Inventory services relying on Erlang TLS certificate validation..

Prepared

May 24, 2026, 09:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.