CVE-2006-4339

Openssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypass

CVSS score

9.1

EPSS probability

%5.1

Risk score

0.5

Published

20 y ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2006-4339 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2006-4339 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

ID	VENDOR	PRODUCT	ACTION
1	Red Hat	Red Hat Enterprise Linux 3	View
2	Red Hat	Red Hat Enterprise Linux 3	View
3	Red Hat	Red Hat Enterprise Linux 4	View
4	Red Hat	Red Hat Enterprise Linux 4	View
5	Red Hat	Red Hat Network Satellite Server v 4.2	View
6	Red Hat	Red Hat Network Satellite Server v 4.2	View
7	Red Hat	Red Hat Network Satellite Server v 4.2 (RHEL3)	View
8	Red Hat	Red Hat Network Satellite Server v 4.2 (RHEL3)	View
9	Red Hat	Red Hat Network Satellite Server v 5.0	View
10	Red Hat	Red Hat Network Satellite Server v 5.0	View
11	Red Hat	Red Hat Network Satellite Server v 5.1	View
12	Red Hat	Red Hat Network Satellite Server v 5.1	View
13	Red Hat	Red Hat Enterprise Linux 10	View
14	Red Hat	Red Hat Enterprise Linux 6	View
15	Red Hat	Red Hat Enterprise Linux 7	View
16	Red Hat	Red Hat Enterprise Linux 8	View
17	Red Hat	Red Hat Enterprise Linux 9	View
18	Red Hat	Red Hat JBoss Core Services	View
19	Red Hat	Red Hat OpenShift Container Platform 4	View
20	openssl	openssl	View
21	openssl	openssl	View
22	openssl	openssl	View
23	openssl	openssl	View
24	openssl	openssl	View
25	openssl	openssl	View
26	openssl	openssl	View
27	openssl	openssl	View
28	openssl	openssl	View
29	openssl	openssl	View
30	openssl	openssl	View
31	openssl	openssl	View
32	openssl	openssl	View
33	openssl	openssl	View
34	openssl	openssl	View
35	openssl	openssl	View
36	openssl	openssl	View
37	openssl	openssl	View
38	openssl	openssl	View
39	openssl	openssl	View
40	openssl	openssl	View
41	openssl	openssl	View
42	openssl	openssl	View
43	openssl	openssl	View
44	openssl	openssl	View
45	openssl	openssl	View
46	openssl	openssl	View
47	openssl	openssl	View
48	openssl	openssl	View
49	openssl	openssl	View
50	openssl	openssl	View
51	openssl	openssl	View
52	openssl	openssl	View
53	openssl	openssl	View
54	openssl	openssl	View

Total affected vendors: 2|Products: 54

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCORE	VERSION	SEVERITY	VECTOR	SOURCE
9.1	CVSS V31	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	NVD
9.1	CVSS V3_1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CVE CNA
4.3	CVSS V2	—	AV:N/AC:M/Au:N/C:P/I:N/A:N	NVD

Patch and Remediation Guide