Unrated severityNVD Advisory· Published Sep 5, 2006· Updated Apr 16, 2026
CVE-2006-4339
CVE-2006-4339
Description
OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.
Affected products
49cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*+ 44 more
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*range: <=0.9.7
- cpe:2.3:a:openssl:openssl:0.9.1c:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.2b:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.3a:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.5a:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.5a:beta1:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.5a:beta2:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.5:beta1:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.5:beta2:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6a:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6a:beta1:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6a:beta2:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6a:beta3:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6b:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6:beta1:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6:beta2:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6:beta3:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6c:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6d:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6e:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6f:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6g:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6h:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6i:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6j:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6k:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6l:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.6m:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7d:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7e:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7f:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7g:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7h:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7i:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.7j:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:*
- osv-coords4 versionspkg:rpm/opensuse/bind&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/openssl-1_0_0&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/openssl-1_1&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/openvpn&distro=openSUSE%20Tumbleweed
< 9.16.20-1.4+ 3 more
- (no CPE)range: < 9.16.20-1.4
- (no CPE)range: < 1.0.2u-6.2
- (no CPE)range: < 1.1.1l-1.2
- (no CPE)range: < 2.5.3-1.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
200- secunia.com/advisories/21709nvdPatchVendor Advisory
- www.debian.org/security/2006/dsa-1174nvdPatch
- www.openssl.org/news/secadv_20060905.txtnvdPatchVendor Advisory
- www.securityfocus.com/bid/19849nvdPatch
- www.ubuntu.com/usn/usn-339-1nvdPatch
- www.us.debian.org/security/2006/dsa-1173nvdPatch
- secunia.com/advisories/21767nvdVendor Advisory
- secunia.com/advisories/21776nvdVendor Advisory
- secunia.com/advisories/21778nvdVendor Advisory
- secunia.com/advisories/21785nvdVendor Advisory
- secunia.com/advisories/21791nvdVendor Advisory
- secunia.com/advisories/21812nvdVendor Advisory
- secunia.com/advisories/21823nvdVendor Advisory
- secunia.com/advisories/21846nvdVendor Advisory
- secunia.com/advisories/21852nvdVendor Advisory
- secunia.com/advisories/21870nvdVendor Advisory
- secunia.com/advisories/21873nvdVendor Advisory
- secunia.com/advisories/21906nvdVendor Advisory
- secunia.com/advisories/21927nvdVendor Advisory
- secunia.com/advisories/21930nvdVendor Advisory
- secunia.com/advisories/21982nvdVendor Advisory
- secunia.com/advisories/22036nvdVendor Advisory
- secunia.com/advisories/22161nvdVendor Advisory
- secunia.com/advisories/22226nvdVendor Advisory
- secunia.com/advisories/22232nvdVendor Advisory
- secunia.com/advisories/22259nvdVendor Advisory
- secunia.com/advisories/22260nvdVendor Advisory
- www.redhat.com/support/errata/RHSA-2006-0661.htmlnvdVendor Advisory
- www.kb.cert.org/vuls/id/845620nvdUS Government Resource
- www.us-cert.gov/cas/techalerts/TA06-333A.htmlnvdUS Government Resource
- patches.sgi.com/support/free/security/advisories/20060901-01-P.ascnvd
- dev2dev.bea.com/pub/advisory/238nvd
- docs.info.apple.com/article.htmlnvd
- docs.info.apple.com/article.htmlnvd
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jspnvd
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jspnvd
- itrc.hp.com/service/cki/docDisplay.donvd
- jvn.jp/en/jp/JVN51615542/index.htmlnvd
- jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000079.htmlnvd
- lists.apple.com/archives/Security-announce/2007/Dec/msg00001.htmlnvd
- lists.apple.com/archives/security-announce/2006/Nov/msg00001.htmlnvd
- lists.vmware.com/pipermail/security-announce/2008/000008.htmlnvd
- marc.infonvd
- marc.infonvd
- openvpn.net/changelog.htmlnvd
- secunia.com/advisories/22044nvd
- secunia.com/advisories/22066nvd
- secunia.com/advisories/22284nvd
- secunia.com/advisories/22325nvd
- secunia.com/advisories/22446nvd
- secunia.com/advisories/22509nvd
- secunia.com/advisories/22513nvd
- secunia.com/advisories/22523nvd
- secunia.com/advisories/22545nvd
- secunia.com/advisories/22585nvd
- secunia.com/advisories/22671nvd
- secunia.com/advisories/22689nvd
- secunia.com/advisories/22711nvd
- secunia.com/advisories/22733nvd
- secunia.com/advisories/22758nvd
- secunia.com/advisories/22799nvd
- secunia.com/advisories/22932nvd
- secunia.com/advisories/22934nvd
- secunia.com/advisories/22936nvd
- secunia.com/advisories/22937nvd
- secunia.com/advisories/22938nvd
- secunia.com/advisories/22939nvd
- secunia.com/advisories/22940nvd
- secunia.com/advisories/22948nvd
- secunia.com/advisories/22949nvd
- secunia.com/advisories/23155nvd
- secunia.com/advisories/23455nvd
- secunia.com/advisories/23680nvd
- secunia.com/advisories/23794nvd
- secunia.com/advisories/23841nvd
- secunia.com/advisories/23915nvd
- secunia.com/advisories/24099nvd
- secunia.com/advisories/24930nvd
- secunia.com/advisories/24950nvd
- secunia.com/advisories/25284nvd
- secunia.com/advisories/25399nvd
- secunia.com/advisories/25649nvd
- secunia.com/advisories/26329nvd
- secunia.com/advisories/26893nvd
- secunia.com/advisories/28115nvd
- secunia.com/advisories/31492nvd
- secunia.com/advisories/38567nvd
- secunia.com/advisories/38568nvd
- secunia.com/advisories/41818nvd
- secunia.com/advisories/60799nvd
- security.freebsd.org/advisories/FreeBSD-SA-06:19.openssl.ascnvd
- security.gentoo.org/glsa/glsa-200609-05.xmlnvd
- security.gentoo.org/glsa/glsa-200609-18.xmlnvd
- securitytracker.com/idnvd
- securitytracker.com/idnvd
- slackware.com/security/viewer.phpnvd
- slackware.com/security/viewer.phpnvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- support.attachmate.com/techdocs/2127.htmlnvd
- support.attachmate.com/techdocs/2128.htmlnvd
- support.attachmate.com/techdocs/2137.htmlnvd
- support.avaya.com/elmodocs2/security/ASA-2006-188.htmnvd
- www.arkoon.fr/upload/alertes/40AK-2006-04-FR-1.1_SSL360_OPENSSL_RSA.pdfnvd
- www.bluecoat.com/support/knowledge/openSSL_RSA_Signature_forgery.htmlnvd
- www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.htmlnvd
- www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtmlnvd
- www.gentoo.org/security/en/glsa/glsa-200610-06.xmlnvd
- www.gentoo.org/security/en/glsa/glsa-201408-19.xmlnvd
- www.imc.org/ietf-openpgp/mail-archive/msg14307.htmlnvd
- www.mandriva.com/security/advisoriesnvd
- www.mandriva.com/security/advisoriesnvd
- www.mandriva.com/security/advisoriesnvd
- www.mandriva.com/security/advisoriesnvd
- www.matasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhere/nvd
- www.novell.com/linux/security/advisories/2006_26_sr.htmlnvd
- www.novell.com/linux/security/advisories/2006_55_ssl.htmlnvd
- www.novell.com/linux/security/advisories/2006_61_opera.htmlnvd
- www.novell.com/linux/security/advisories/2007_10_ibmjava.htmlnvd
- www.openbsd.org/errata.htmlnvd
- www.openoffice.org/security/cves/CVE-2006-4339.htmlnvd
- www.openpkg.com/security/advisories/OpenPKG-SA-2006.018.htmlnvd
- www.openpkg.org/security/advisories/OpenPKG-SA-2006.029-bind.htmlnvd
- www.opera.com/support/search/supsearch.dmlnvd
- www.oracle.com/technetwork/topics/security/cpujan2007-101493.htmlnvd
- www.osvdb.org/28549nvd
- www.redhat.com/support/errata/RHSA-2007-0062.htmlnvd
- www.redhat.com/support/errata/RHSA-2007-0072.htmlnvd
- www.redhat.com/support/errata/RHSA-2007-0073.htmlnvd
- www.redhat.com/support/errata/RHSA-2008-0629.htmlnvd
- www.securityfocus.com/archive/1/445231/100/0/threadednvd
- www.securityfocus.com/archive/1/445822/100/0/threadednvd
- www.securityfocus.com/archive/1/450327/100/0/threadednvd
- www.securityfocus.com/archive/1/456546/100/200/threadednvd
- www.securityfocus.com/archive/1/489739/100/0/threadednvd
- www.securityfocus.com/bid/22083nvd
- www.securityfocus.com/bid/28276nvd
- www.serv-u.com/releasenotes/nvd
- www.sybase.com/detailnvd
- www.vmware.com/security/advisories/VMSA-2008-0005.htmlnvd
- www.vmware.com/support/ace2/doc/releasenotes_ace2.htmlnvd
- www.vmware.com/support/esx2/doc/esx-202-200612-patch.htmlnvd
- www.vmware.com/support/esx21/doc/esx-213-200612-patch.htmlnvd
- www.vmware.com/support/esx25/doc/esx-253-200612-patch.htmlnvd
- www.vmware.com/support/esx25/doc/esx-254-200612-patch.htmlnvd
- www.vmware.com/support/player/doc/releasenotes_player.htmlnvd
- www.vmware.com/support/player2/doc/releasenotes_player2.htmlnvd
- www.vmware.com/support/server/doc/releasenotes_server.htmlnvd
- www.vmware.com/support/vi3/doc/esx-3069097-patch.htmlnvd
- www.vmware.com/support/vi3/doc/esx-9986131-patch.htmlnvd
- www.vmware.com/support/ws55/doc/releasenotes_ws55.htmlnvd
- www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlnvd
- www.vupen.com/english/advisories/2006/3453nvd
- www.vupen.com/english/advisories/2006/3566nvd
- www.vupen.com/english/advisories/2006/3730nvd
- www.vupen.com/english/advisories/2006/3748nvd
- www.vupen.com/english/advisories/2006/3793nvd
- www.vupen.com/english/advisories/2006/3899nvd
- www.vupen.com/english/advisories/2006/3936nvd
- www.vupen.com/english/advisories/2006/4205nvd
- www.vupen.com/english/advisories/2006/4206nvd
- www.vupen.com/english/advisories/2006/4207nvd
- www.vupen.com/english/advisories/2006/4216nvd
- www.vupen.com/english/advisories/2006/4327nvd
- www.vupen.com/english/advisories/2006/4329nvd
- www.vupen.com/english/advisories/2006/4366nvd
- www.vupen.com/english/advisories/2006/4417nvd
- www.vupen.com/english/advisories/2006/4586nvd
- www.vupen.com/english/advisories/2006/4744nvd
- www.vupen.com/english/advisories/2006/4750nvd
- www.vupen.com/english/advisories/2006/5146nvd
- www.vupen.com/english/advisories/2007/0254nvd
- www.vupen.com/english/advisories/2007/0343nvd
- www.vupen.com/english/advisories/2007/1401nvd
- www.vupen.com/english/advisories/2007/1815nvd
- www.vupen.com/english/advisories/2007/1945nvd
- www.vupen.com/english/advisories/2007/2163nvd
- www.vupen.com/english/advisories/2007/2315nvd
- www.vupen.com/english/advisories/2007/2783nvd
- www.vupen.com/english/advisories/2007/4224nvd
- www.vupen.com/english/advisories/2008/0905/referencesnvd
- www.vupen.com/english/advisories/2010/0366nvd
- www1.itrc.hp.com/service/cki/docDisplay.donvd
- www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjdnvd
- exchange.xforce.ibmcloud.com/vulnerabilities/28755nvd
- issues.rpath.com/browse/RPL-1633nvd
- issues.rpath.com/browse/RPL-616nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11656nvd
- secure-support.novell.com/KanisaPlatform/Publishing/41/3143224_f.SAL_Public.htmlnvd
- www2.itrc.hp.com/service/cki/docDisplay.donvd
News mentions
0No linked articles in our index yet.