{"api_version":"1","generated_at":"2026-07-23T06:41:21+00:00","cve":"CVE-2008-0227","urls":{"html":"https://cve.report/CVE-2008-0227","api":"https://cve.report/api/cve/CVE-2008-0227.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-0227","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-0227"},"summary":{"title":"CVE-2008-0227","description":"yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allows remote attackers to cause a denial of service (crash) via a Hello packet containing a large size value, which triggers a buffer over-read in the HASHwithTransform::Update function in hash.cpp.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-01-10 23:46:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2008/0560/references","name":"http://www.vupen.com/english/advisories/2008/0560/references","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://bugs.mysql.com/33814","name":"http://bugs.mysql.com/33814","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"MySQL Bugs: #33814: Pre-auth buffer-overflow in mySQL through yaSSL","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/28324","name":"http://secunia.com/advisories/28324","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"yaSSL Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2008/dsa-1478","name":"http://www.debian.org/security/2008/dsa-1478","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-1478-1 mysql-dfsg-5.0","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/29443","name":"http://secunia.com/advisories/29443","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Ubuntu update for mysql-dfsg-5.0 - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32222","name":"http://secunia.com/advisories/32222","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apple Mac OS X Security Update Fixes Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/27140","name":"http://www.securityfocus.com/bid/27140","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"yaSSL Multiple Remote Buffer Overflow Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2008/2780","name":"http://www.vupen.com/english/advisories/2008/2780","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/28597","name":"http://secunia.com/advisories/28597","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian update for mysql-dfsg-5.0 - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://support.apple.com/kb/HT3216","name":"http://support.apple.com/kb/HT3216","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About Security Update 2008-007","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/485810/100/0/threaded","name":"http://www.securityfocus.com/archive/1/485810/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/3531","name":"http://securityreason.com/securityalert/3531","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Multiple vulnerabilities in yaSSL 1.7.5 - SecurityReason.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39433","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39433","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html","name":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"APPLE-SA-2008-10-09 Security Update 2008-007","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/31681","name":"http://www.securityfocus.com/bid/31681","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"RETIRED: Apple Mac OS X 2008-007 Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ubuntu.com/usn/usn-588-1","name":"http://www.ubuntu.com/usn/usn-588-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-588-1: MySQL vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html","name":"http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"MySQL ::   MySQL 5.1 Reference Manual :: C.1.9 Changes in  MySQL 5.1.23 (29 January 2008)","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:150","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:150","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Advisories | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-0227","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0227","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"227","vulnerable":"1","versionEndIncluding":"1.7.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"yassl","cpe5":"yassl","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[{"cvename":"CVE-2008-0227","organization":"Red Hat","lastmodified":"2008-01-11","contributor":"Mark J Cox","statementText":"Not vulnerable. This issue did not affect versions of MySQL as shipped with Red Hat Enterprise Linux 2.1, 3, 4, 5, Red Hat Application Stack v1, and v2, as they are not built with yaSSL support.","cve_year":"2008","cve_id":"227","crc32":"be5fd48e"}],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T07:39:34.149Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"DSA-1478","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2008/dsa-1478"},{"name":"29443","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/29443"},{"name":"20080104 Multiple vulnerabilities in yaSSL 1.7.5","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/485810/100/0/threaded"},{"name":"28324","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/28324"},{"name":"3531","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/3531"},{"name":"31681","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/31681"},{"name":"yassl-hashwithtransformupdate-dos(39433)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39433"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://bugs.mysql.com/33814"},{"name":"27140","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/27140"},{"name":"28597","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/28597"},{"name":"ADV-2008-0560","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/0560/references"},{"name":"32222","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32222"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html"},{"name":"ADV-2008-2780","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2780"},{"name":"USN-588-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/usn-588-1"},{"name":"MDVSA-2008:150","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:150"},{"name":"APPLE-SA-2008-10-09","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"],"url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.apple.com/kb/HT3216"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-01-04T00:00:00.000Z","descriptions":[{"lang":"en","value":"yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allows remote attackers to cause a denial of service (crash) via a Hello packet containing a large size value, which triggers a buffer over-read in the HASHwithTransform::Update function in hash.cpp."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-15T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"DSA-1478","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2008/dsa-1478"},{"name":"29443","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/29443"},{"name":"20080104 Multiple vulnerabilities in yaSSL 1.7.5","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/485810/100/0/threaded"},{"name":"28324","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/28324"},{"name":"3531","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/3531"},{"name":"31681","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/31681"},{"name":"yassl-hashwithtransformupdate-dos(39433)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39433"},{"tags":["x_refsource_CONFIRM"],"url":"http://bugs.mysql.com/33814"},{"name":"27140","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/27140"},{"name":"28597","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/28597"},{"name":"ADV-2008-0560","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/0560/references"},{"name":"32222","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32222"},{"tags":["x_refsource_CONFIRM"],"url":"http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html"},{"name":"ADV-2008-2780","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2780"},{"name":"USN-588-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/usn-588-1"},{"name":"MDVSA-2008:150","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:150"},{"name":"APPLE-SA-2008-10-09","tags":["vendor-advisory","x_refsource_APPLE"],"url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://support.apple.com/kb/HT3216"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-0227","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allows remote attackers to cause a denial of service (crash) via a Hello packet containing a large size value, which triggers a buffer over-read in the HASHwithTransform::Update function in hash.cpp."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"DSA-1478","refsource":"DEBIAN","url":"http://www.debian.org/security/2008/dsa-1478"},{"name":"29443","refsource":"SECUNIA","url":"http://secunia.com/advisories/29443"},{"name":"20080104 Multiple vulnerabilities in yaSSL 1.7.5","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/485810/100/0/threaded"},{"name":"28324","refsource":"SECUNIA","url":"http://secunia.com/advisories/28324"},{"name":"3531","refsource":"SREASON","url":"http://securityreason.com/securityalert/3531"},{"name":"31681","refsource":"BID","url":"http://www.securityfocus.com/bid/31681"},{"name":"yassl-hashwithtransformupdate-dos(39433)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39433"},{"name":"http://bugs.mysql.com/33814","refsource":"CONFIRM","url":"http://bugs.mysql.com/33814"},{"name":"27140","refsource":"BID","url":"http://www.securityfocus.com/bid/27140"},{"name":"28597","refsource":"SECUNIA","url":"http://secunia.com/advisories/28597"},{"name":"ADV-2008-0560","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/0560/references"},{"name":"32222","refsource":"SECUNIA","url":"http://secunia.com/advisories/32222"},{"name":"http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html","refsource":"CONFIRM","url":"http://dev.mysql.com/doc/refman/5.1/en/news-5-1-23.html"},{"name":"ADV-2008-2780","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2780"},{"name":"USN-588-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/usn-588-1"},{"name":"MDVSA-2008:150","refsource":"MANDRIVA","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:150"},{"name":"APPLE-SA-2008-10-09","refsource":"APPLE","url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"},{"name":"http://support.apple.com/kb/HT3216","refsource":"CONFIRM","url":"http://support.apple.com/kb/HT3216"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-0227","datePublished":"2008-01-10T23:00:00.000Z","dateReserved":"2008-01-10T00:00:00.000Z","dateUpdated":"2024-08-07T07:39:34.149Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-01-10 23:46:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":true,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:yassl:yassl:*:*:*:*:*:*:*:*","versionEndIncluding":"1.7.5","matchCriteriaId":"0E11538C-D2F9-4D94-8C84-69BDC305D744"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"227","Ordinal":"1","Title":"CVE-2008-0227","CVE":"CVE-2008-0227","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"227","Ordinal":"1","NoteData":"yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allows remote attackers to cause a denial of service (crash) via a Hello packet containing a large size value, which triggers a buffer over-read in the HASHwithTransform::Update function in hash.cpp.","Type":"Description","Title":"CVE-2008-0227"},{"CveYear":"2008","CveId":"227","Ordinal":"2","NoteData":"2008-01-10","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"227","Ordinal":"3","NoteData":"2018-10-15","Type":"Other","Title":"Modified"}]}}}