-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security/ http://www.openpkg.org openpkg-security@xxxxxxxxxxx openpkg@xxxxxxxxxxx OpenPKG-SA-2006.018 06-Sep-2006 ________________________________________________________________________ Package: openssl Vulnerability: signature verification failure OpenPKG Specific: no Affected Releases: Affected Packages: Corrected Packages: OpenPKG CURRENT <= openssl-0.9.8b-20060505 >= openssl-0.9.8c-20060905 OpenPKG 2-STABLE <= openssl-0.9.8b-2.20060622 >= openssl-0.9.8c-2.20060906 OpenPKG 2.5-RELEASE <= openssl-0.9.8a-2.5.1 >= openssl-0.9.8a-2.5.2 Description: According to a vendor security advisory [0], Daniel Bleichenbacher described a possible attack on PKCS #1 v1.5 signatures which affects the cryptography and SSL/TLS toolkit OpenSSL [1]. If an RSA key with exponent 3 is used it may be possible to forge a PKCS #1 v1.5 signature signed by that key. Implementations may incorrectly verify the certificate if they are not checking for excess data in the RSA exponentiation result of the signature. Since there are CAs using exponent 3 in wide use, and PKCS #1 v1.5 is used in X.509 certificates, all software that uses OpenSSL to verify X.509 certificates is potentially vulnerable, as well as any other use of PKCS #1 v1.5. This includes software that uses OpenSSL for SSL or TLS. The Common Vulnerabilities and Exposures (CVE) project assigned the id CVE-2006-4339 [2] to the problem. ________________________________________________________________________ References: [0] http://www.openssl.org/news/secadv_20060905.txt [1] http://www.openssl.org/ [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339 ________________________________________________________________________ For security reasons, this advisory was digitally signed with the OpenPGP public key "OpenPKG <openpkg@xxxxxxxxxxx>" (ID 63C4CB9F) of the OpenPKG project which you can retrieve from http://pgp.openpkg.org and hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org for details on how to verify the integrity of this advisory. ________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Comment: OpenPKG <openpkg@xxxxxxxxxxx> iD8DBQFE/o9xgHWT4GPEy58RAn09AJ0RvSOCTihCxY4vWJdKsh9a/tpr5ACggXBe dEOgfhj33twaWWmWa0T7zio= =zkpQ -----END PGP SIGNATURE-----
