OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-1185-1 | New openssl packages fix denial of service |
Debian DSA |
DSA-1185-2 | New openssl packages fix arbitrary code execution |
Debian DSA |
DSA-1195-1 | new openssl096 packages fix denial of service |
Ubuntu USN |
USN-353-1 | openssl vulnerabilities |
Ubuntu USN |
USN-353-2 | OpenSSL vulnerability |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 16 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-07T18:06:27.233Z
Reserved: 2006-06-09T00:00:00
Link: CVE-2006-2940
No data.
Status : Deferred
Published: 2006-09-28T18:07:00.000
Modified: 2025-04-09T00:30:58.490
Link: CVE-2006-2940
OpenCVE Enrichment
No data.
Debian DSA
Ubuntu USN