p PatchFirst

CVE-2006-4339

CVE-2006-4339

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.

EPSS 5.1% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • openssl Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.9.8b-3

    Update to 0.9.8b-3

  • openssl Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.9.8b-3

    Update to 0.9.8b-3

  • openssl Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.9.8b-3

    Update to 0.9.8b-3

Original sources

Check your server →