CVE-2006-2940

See a problem?

Source

https://nvd.nist.gov/vuln/detail/CVE-2006-2940

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2006-2940.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2006-2940

Related

Published

2006-09-28T18:07:00Z

Modified

2024-09-11T02:00:07Z

Summary

[none]

Details

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.

References

Affected packages

Debian:11 / openssl

Package

Name: openssl
Purl: pkg:deb/debian/openssl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.8c-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / openssl

Package

Name: openssl
Purl: pkg:deb/debian/openssl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.8c-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / openssl

Package

Name: openssl
Purl: pkg:deb/debian/openssl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.8c-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}