Unrated severityNVD Advisory· Published Sep 14, 2006· Updated Apr 16, 2026
CVE-2006-4790
CVE-2006-4790
Description
verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents GnuTLS from correctly verifying X.509 and other certificates that use PKCS, a variant of CVE-2006-4339.
Affected products
41cpe:2.3:a:gnu:gnutls:1.0.17:*:*:*:*:*:*:*+ 39 more
- cpe:2.3:a:gnu:gnutls:1.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.0.19:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.0.21:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.0.22:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.0.23:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.0.24:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.0.25:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.16:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.17:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.18:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.19:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.20:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.21:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.22:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.1.23:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.8.1a1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:gnu:gnutls:1.4.1:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
30- www.gnu.org/software/gnutls/security.htmlnvdPatch
- www.redhat.com/support/errata/RHSA-2006-0680.htmlnvdPatchVendor Advisory
- lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.htmlnvd
- lists.gnupg.org/pipermail/gnutls-dev/2006-September/001212.htmlnvd
- secunia.com/advisories/21937nvd
- secunia.com/advisories/21942nvd
- secunia.com/advisories/21973nvd
- secunia.com/advisories/22049nvd
- secunia.com/advisories/22080nvd
- secunia.com/advisories/22084nvd
- secunia.com/advisories/22097nvd
- secunia.com/advisories/22226nvd
- secunia.com/advisories/22992nvd
- secunia.com/advisories/25762nvd
- security.gentoo.org/glsa/glsa-200609-15.xmlnvd
- securitytracker.com/idnvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- support.avaya.com/elmodocs2/security/ASA-2006-250.htmnvd
- www.debian.org/security/2006/dsa-1182nvd
- www.mandriva.com/security/advisoriesnvd
- www.novell.com/linux/security/advisories/2006_23_sr.htmlnvd
- www.novell.com/linux/security/advisories/2007_10_ibmjava.htmlnvd
- www.securityfocus.com/bid/20027nvd
- www.ubuntu.com/usn/usn-348-1nvd
- www.vupen.com/english/advisories/2006/3635nvd
- www.vupen.com/english/advisories/2006/3899nvd
- www.vupen.com/english/advisories/2007/2289nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/28953nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9937nvd
News mentions
0No linked articles in our index yet.