Описание
A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | released | 0.9.8a-7ubuntu0.3 |
| devel | released | 0.9.8b-2ubuntu2 |
| edgy | released | 0.9.8b-2ubuntu2 |
| feisty | released | 0.9.8b-2ubuntu2 |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | released | 0.9.7g-5ubuntu1.1 |
| devel | released | 0.9.7k-3 |
| edgy | released | 0.9.7k-3 |
| feisty | released | 0.9.7k-3 |
| upstream | needs-triage |
Показывать по
EPSS
4.3 Medium
CVSS2
9.1 Critical
CVSS3
Связанные уязвимости
OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.
A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.
A flaw was found in OpenSSL. When configured to use an RSA key with ex ...
OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.
Уязвимость операционной системы Gentoo Linux, позволяющая удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
EPSS
4.3 Medium
CVSS2
9.1 Critical
CVSS3