CVE-2006-4339

Publication date 5 September 2006

Last updated 24 July 2024

Ubuntu priority

Unknown

Why this priority?

OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
openssl 7.04 feisty
Fixed 0.9.8b-2ubuntu2
6.10 edgy
Fixed 0.9.8b-2ubuntu2
6.06 LTS dapper
Fixed 0.9.8a-7ubuntu0.3
openssl097 7.04 feisty
Fixed 0.9.7k-3
6.10 edgy
Fixed 0.9.7k-3
6.06 LTS dapper
Fixed 0.9.7g-5ubuntu1.1

References

Related Ubuntu Security Notices (USN)

    • USN-339-1
    • OpenSSL vulnerability
    • 5 September 2006

Other references