$ cve CVE-2002-0082 JSON

CVE-2002-0082 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 29.7% (pctl 98)

Patch early

A public exploit exists.

Description

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	29.66% — more likely to be exploited than 98% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2002-03-15
Last modified	2026-06-16

Affected (2)

Vendor	Product
apache-ssl	apache-ssl
mod ssl	mod ssl

Public exploits

Source	Title	Date
exploit-db	Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (2)	2019-07-07
exploit-db	Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (1)	2003-04-04
exploit-db	Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Buffer Overflow	2002-07-30

References

→ the Explorer · watch your stack · NVD