Openssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypass
Priority MEDIUM 46CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-347.
Summary
A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.
Why it matters now
EPSS 0.03948 90th percentileScored 2026-11-07
Fix Fixed Red Hat: 7 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 3 | — | 0.9.7a-33.18 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 3 | — | 0.9.6b-16.43 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 4 | — | 0.9.7a-43.11 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 4 | — | 0.9.6b-22.43 | Patch available | CNA |
| Red Hat | Red Hat Network Satellite Server v 4.2 | — | 5.0.2-3 | Patch available | CNA |
| Red Hat | Red Hat Network Satellite Server v 4.2 | — | 1-0 | Patch available | CNA |
| Red Hat | Red Hat Network Satellite Server v 4.2 (RHEL3) | — | 5.0.2-3 | Patch available | CNA |
| Red Hat | Red Hat Network Satellite Server v 4.2 (RHEL3) | — | 1-0 | Patch available | CNA |
| Red Hat | Red Hat Network Satellite Server v 5.0 | — | 5.0.2-3 | Patch available | CNA |
| Red Hat | Red Hat Network Satellite Server v 5.0 | — | 1-0 | Patch available | CNA |
| Red Hat | Red Hat Network Satellite Server v 5.1 | — | 5.1.1-3 | Patch available | CNA |
| Red Hat | Red Hat Network Satellite Server v 5.1 | — | 1-0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Core Services | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
- Red Hat Enterprise Linux 3 VendorRed Hat Affected — Fixed in 0.9.7a-33.18 Patch available CNA
- Red Hat Enterprise Linux 3 VendorRed Hat Affected — Fixed in 0.9.6b-16.43 Patch available CNA
- Red Hat Enterprise Linux 4 VendorRed Hat Affected — Fixed in 0.9.7a-43.11 Patch available CNA
- Red Hat Enterprise Linux 4 VendorRed Hat Affected — Fixed in 0.9.6b-22.43 Patch available CNA
- Red Hat Network Satellite Server v 4.2 VendorRed Hat Affected — Fixed in 5.0.2-3 Patch available CNA
- Red Hat Network Satellite Server v 4.2 VendorRed Hat Affected — Fixed in 1-0 Patch available CNA
- Red Hat Network Satellite Server v 4.2 (RHEL3) VendorRed Hat Affected — Fixed in 5.0.2-3 Patch available CNA
- Red Hat Network Satellite Server v 4.2 (RHEL3) VendorRed Hat Affected — Fixed in 1-0 Patch available CNA
- Red Hat Network Satellite Server v 5.0 VendorRed Hat Affected — Fixed in 5.0.2-3 Patch available CNA
- Red Hat Network Satellite Server v 5.0 VendorRed Hat Affected — Fixed in 1-0 Patch available CNA
- Red Hat Network Satellite Server v 5.1 VendorRed Hat Affected — Fixed in 5.1.1-3 Patch available CNA
- Red Hat Network Satellite Server v 5.1 VendorRed Hat Affected — Fixed in 1-0 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Core Services VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE configurations NVD · 45
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | up to 0.9.7 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.1c:*:*:*:*:*:*:* | 0.9.1c | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.2b:*:*:*:*:*:*:* | 0.9.2b | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.3:*:*:*:*:*:*:* | 0.9.3 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.3a:*:*:*:*:*:*:* | 0.9.3a | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.4:*:*:*:*:*:*:* | 0.9.4 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.5:*:*:*:*:*:*:* | 0.9.5 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.5:beta1:*:*:*:*:*:* | 0.9.5 beta1 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.5:beta2:*:*:*:*:*:* | 0.9.5 beta2 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.5a:*:*:*:*:*:*:* | 0.9.5a | Vulnerable | OpenSSL |
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions up to 0.9.7 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.1c:*:*:*:*:*:*:* Versions 0.9.1c Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.2b:*:*:*:*:*:*:* Versions 0.9.2b Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.3a:*:*:*:*:*:*:* Versions 0.9.3a Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.5:*:*:*:*:*:*:* Versions 0.9.5 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.5:beta1:*:*:*:*:*:* Versions 0.9.5 beta1 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.5:beta2:*:*:*:*:*:* Versions 0.9.5 beta2 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.5a:*:*:*:*:*:*:* Versions 0.9.5a Vulnerable ·OpenSSL
Show 35 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openssl:openssl:0.9.5a:beta1:*:*:*:*:*:* | 0.9.5a beta1 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.5a:beta2:*:*:*:*:*:* | 0.9.5a beta2 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6:*:*:*:*:*:*:* | 0.9.6 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6:beta1:*:*:*:*:*:* | 0.9.6 beta1 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6:beta2:*:*:*:*:*:* | 0.9.6 beta2 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6:beta3:*:*:*:*:*:* | 0.9.6 beta3 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6a:*:*:*:*:*:*:* | 0.9.6a | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6a:beta1:*:*:*:*:*:* | 0.9.6a beta1 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6a:beta2:*:*:*:*:*:* | 0.9.6a beta2 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6a:beta3:*:*:*:*:*:* | 0.9.6a beta3 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6b:*:*:*:*:*:*:* | 0.9.6b | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6c:*:*:*:*:*:*:* | 0.9.6c | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6d:*:*:*:*:*:*:* | 0.9.6d | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6e:*:*:*:*:*:*:* | 0.9.6e | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6f:*:*:*:*:*:*:* | 0.9.6f | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6g:*:*:*:*:*:*:* | 0.9.6g | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6h:*:*:*:*:*:*:* | 0.9.6h | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6i:*:*:*:*:*:*:* | 0.9.6i | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6j:*:*:*:*:*:*:* | 0.9.6j | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6k:*:*:*:*:*:*:* | 0.9.6k | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6l:*:*:*:*:*:*:* | 0.9.6l | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.6m:*:*:*:*:*:*:* | 0.9.6m | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:* | 0.9.7a | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:* | 0.9.7b | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:* | 0.9.7c | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7d:*:*:*:*:*:*:* | 0.9.7d | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7e:*:*:*:*:*:*:* | 0.9.7e | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7f:*:*:*:*:*:*:* | 0.9.7f | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7g:*:*:*:*:*:*:* | 0.9.7g | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7h:*:*:*:*:*:*:* | 0.9.7h | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7i:*:*:*:*:*:*:* | 0.9.7i | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.7j:*:*:*:*:*:*:* | 0.9.7j | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:* | 0.9.8 | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:* | 0.9.8a | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:* | 0.9.8b | Vulnerable | OpenSSL |
- cpe:2.3:a:openssl:openssl:0.9.5a:beta1:*:*:*:*:*:* Versions 0.9.5a beta1 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.5a:beta2:*:*:*:*:*:* Versions 0.9.5a beta2 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6:*:*:*:*:*:*:* Versions 0.9.6 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6:beta1:*:*:*:*:*:* Versions 0.9.6 beta1 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6:beta2:*:*:*:*:*:* Versions 0.9.6 beta2 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6:beta3:*:*:*:*:*:* Versions 0.9.6 beta3 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6a:*:*:*:*:*:*:* Versions 0.9.6a Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6a:beta1:*:*:*:*:*:* Versions 0.9.6a beta1 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6a:beta2:*:*:*:*:*:* Versions 0.9.6a beta2 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6a:beta3:*:*:*:*:*:* Versions 0.9.6a beta3 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6b:*:*:*:*:*:*:* Versions 0.9.6b Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6c:*:*:*:*:*:*:* Versions 0.9.6c Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6d:*:*:*:*:*:*:* Versions 0.9.6d Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6e:*:*:*:*:*:*:* Versions 0.9.6e Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6f:*:*:*:*:*:*:* Versions 0.9.6f Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6g:*:*:*:*:*:*:* Versions 0.9.6g Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6h:*:*:*:*:*:*:* Versions 0.9.6h Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6i:*:*:*:*:*:*:* Versions 0.9.6i Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6j:*:*:*:*:*:*:* Versions 0.9.6j Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6k:*:*:*:*:*:*:* Versions 0.9.6k Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6l:*:*:*:*:*:*:* Versions 0.9.6l Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.6m:*:*:*:*:*:*:* Versions 0.9.6m Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:* Versions 0.9.7a Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:* Versions 0.9.7b Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:* Versions 0.9.7c Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7d:*:*:*:*:*:*:* Versions 0.9.7d Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7e:*:*:*:*:*:*:* Versions 0.9.7e Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7f:*:*:*:*:*:*:* Versions 0.9.7f Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7g:*:*:*:*:*:*:* Versions 0.9.7g Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7h:*:*:*:*:*:*:* Versions 0.9.7h Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7i:*:*:*:*:*:*:* Versions 0.9.7i Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.7j:*:*:*:*:*:*:* Versions 0.9.7j Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:* Versions 0.9.8a Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:* Versions 0.9.8b Vulnerable ·OpenSSL
Remediation
Red Hat 7 advisories
- RHSA-2008:0629 Released 2008-08-13 · Red Hat rating ModerateRed Hat Network Satellite Server Solaris client security update
- Red Hat Satellite 5.1 (RHEL v.4 AS) rhn-solaris-bootstrap-5.1.1-3, rhn_solaris_bootstrap_5_1_1_3-1-0
- RHSA-2008:0525 Released 2008-06-30 · Red Hat rating ModerateRed Hat Network Satellite Server Solaris client security update
- Red Hat Satellite v 4.2 (RHEL v.3 AS) rhn-solaris-bootstrap-5.0.2-3, rhn_solaris_bootstrap_5_0_2_3-1-0
- Red Hat Satellite v 4.2 (RHEL v.4 AS) rhn-solaris-bootstrap-5.0.2-3, rhn_solaris_bootstrap_5_0_2_3-1-0
- RHSA-2008:0264 Released 2008-05-20 · Red Hat rating ModerateRed Hat Network Satellite Server Solaris client security update
- Red Hat Satellite 5.0 (RHEL v.4 AS) rhn-solaris-bootstrap-5.0.2-3, rhn_solaris_bootstrap_5_0_2_3-1-0
Show 4 more Red Hat advisories
- RHSA-2007:0073 Released 2007-02-09 · Red Hat rating Criticaljava-1.5.0-ibm security update
- Red Hat Desktop version 4 Extras java-1.5.0-ibm-1:1.5.0.3-1jpp.3.el4, java-1.5.0-ibm-1:1.5.0.3-1jpp.3.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.3-1jpp.3.el4 +9
- Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-ibm-1:1.5.0.3-1jpp.3.el4, java-1.5.0-ibm-1:1.5.0.3-1jpp.3.el4.i386, java-1.5.0-ibm-1:1.5.0.3-1jpp.3.el4.ppc +17
- Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-ibm-1:1.5.0.3-1jpp.3.el4, java-1.5.0-ibm-1:1.5.0.3-1jpp.3.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.3-1jpp.3.el4 +9
- Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-ibm-1:1.5.0.3-1jpp.3.el4, java-1.5.0-ibm-1:1.5.0.3-1jpp.3.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.3-1jpp.3.el4 +9
- RHSA-2007:0062 Released 2007-02-07 · Red Hat rating Criticaljava-1.4.2-ibm security update
- Red Hat Desktop version 3 Extras java-1.4.2-ibm-1.4.2.7-1jpp.4.el3, java-1.4.2-ibm-1.4.2.7-1jpp.4.el3.i386, java-1.4.2-ibm-demo-1.4.2.7-1jpp.4.el3 +7
- Red Hat Desktop version 4 Extras java-1.4.2-ibm-1.4.2.7-1jpp.4.el4, java-1.4.2-ibm-1.4.2.7-1jpp.4.el4.i386, java-1.4.2-ibm-demo-1.4.2.7-1jpp.4.el4 +9
- Red Hat Enterprise Linux AS version 3 Extras java-1.4.2-ibm-1.4.2.7-1jpp.4.el3, java-1.4.2-ibm-1.4.2.7-1jpp.4.el3.i386, java-1.4.2-ibm-1.4.2.7-1jpp.4.el3.ia64 +17
- Red Hat Enterprise Linux AS version 4 Extras java-1.4.2-ibm-1.4.2.7-1jpp.4.el4, java-1.4.2-ibm-1.4.2.7-1jpp.4.el4.i386, java-1.4.2-ibm-1.4.2.7-1jpp.4.el4.ia64 +20
- Red Hat Enterprise Linux ES version 3 Extras java-1.4.2-ibm-1.4.2.7-1jpp.4.el3, java-1.4.2-ibm-1.4.2.7-1jpp.4.el3.i386, java-1.4.2-ibm-1.4.2.7-1jpp.4.el3.ia64 +11
- Red Hat Enterprise Linux ES version 4 Extras java-1.4.2-ibm-1.4.2.7-1jpp.4.el4, java-1.4.2-ibm-1.4.2.7-1jpp.4.el4.i386, java-1.4.2-ibm-1.4.2.7-1jpp.4.el4.ia64 +13
- Red Hat Enterprise Linux WS version 3 Extras java-1.4.2-ibm-1.4.2.7-1jpp.4.el3, java-1.4.2-ibm-1.4.2.7-1jpp.4.el3.i386, java-1.4.2-ibm-1.4.2.7-1jpp.4.el3.ia64 +11
- Red Hat Enterprise Linux WS version 4 Extras java-1.4.2-ibm-1.4.2.7-1jpp.4.el4, java-1.4.2-ibm-1.4.2.7-1jpp.4.el4.i386, java-1.4.2-ibm-1.4.2.7-1jpp.4.el4.ia64 +13
- RHSA-2007:0072 Released 2007-01-24 · Red Hat rating CriticalIBMJava2 security update
- Red Hat Enterprise Linux AS (Advanced Server) version 2.1 IBMJava2-JRE-1:1.3.1-12, IBMJava2-JRE-1:1.3.1-12.i386, IBMJava2-SDK-1:1.3.1-11 +1
- Red Hat Enterprise Linux ES version 2.1 IBMJava2-JRE-1:1.3.1-12, IBMJava2-JRE-1:1.3.1-12.i386, IBMJava2-SDK-1:1.3.1-11 +1
- Red Hat Enterprise Linux WS version 2.1 IBMJava2-JRE-1:1.3.1-12, IBMJava2-JRE-1:1.3.1-12.i386, IBMJava2-SDK-1:1.3.1-11 +1
- RHSA-2006:0661 Released 2006-09-06 · Red Hat rating Importantopenssl security update
- Red Hat Desktop version 3 openssl-0.9.7a-33.18, openssl-0.9.7a-33.18.i386, openssl-devel-0.9.7a-33.18 +5
- Red Hat Enterprise Linux AS version 3 openssl-0.9.7a-33.18, openssl-0.9.7a-33.18.i386, openssl-0.9.7a-33.18.ia64 +13
- Red Hat Enterprise Linux AS version 4 openssl-0.9.7a-43.11, openssl-0.9.7a-43.11.i386, openssl-0.9.7a-43.11.ia64 +13
- Red Hat Enterprise Linux Desktop version 4 openssl-0.9.7a-43.11, openssl-0.9.7a-43.11.i386, openssl-devel-0.9.7a-43.11 +5
- Red Hat Enterprise Linux ES version 3 openssl-0.9.7a-33.18, openssl-0.9.7a-33.18.i386, openssl-0.9.7a-33.18.ia64 +9
- Red Hat Enterprise Linux ES version 4 openssl-0.9.7a-43.11, openssl-0.9.7a-43.11.i386, openssl-0.9.7a-43.11.ia64 +9
- Red Hat Enterprise Linux WS version 3 openssl-0.9.7a-33.18, openssl-0.9.7a-33.18.i386, openssl-0.9.7a-33.18.ia64 +9
- Red Hat Enterprise Linux WS version 4 openssl-0.9.7a-43.11, openssl-0.9.7a-43.11.i386, openssl-0.9.7a-43.11.ia64 +9
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Desktop version 3 | Fixed | RHSA-2006:0661 |
| Red Hat Enterprise Linux AS version 3 | Fixed | RHSA-2006:0661 |
| Red Hat Enterprise Linux AS version 4 | Fixed | RHSA-2006:0661 |
| Red Hat Enterprise Linux Desktop version 4 | Fixed | RHSA-2006:0661 |
| Red Hat Enterprise Linux ES version 3 | Fixed | RHSA-2006:0661 |
| Red Hat Enterprise Linux ES version 4 | Fixed | RHSA-2006:0661 |
| Red Hat Enterprise Linux WS version 3 | Fixed | RHSA-2006:0661 |
| Red Hat Enterprise Linux WS version 4 | Fixed | RHSA-2006:0661 |
| Red Hat Satellite 5.0 (RHEL v.4 AS) | Fixed | RHSA-2008:0264 |
| Red Hat Satellite 5.1 (RHEL v.4 AS) | Fixed | RHSA-2008:0629 |
| Red Hat Satellite v 4.2 (RHEL v.3 AS) | Fixed | RHSA-2008:0525 |
| Red Hat Satellite v 4.2 (RHEL v.4 AS) | Fixed | RHSA-2008:0525 |
Not affected: 7 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2006-4339
- 2026-10-03 Alias added: GHSA-cw9v-mmf8-gmmr
- 2026-10-30 Title updated · CNA
- 2026-10-30 CVSS score added · CNA
- 2026-10-30 Weakness changed · CNA
- 2026-10-30 Fix available: openssl096b@0:0.9.6b-16.43, openssl096b@0:0.9.6b-22.43, openssl@0:0.9.7a-33.18 +5 · CNA
- 2026-10-30 8 new references · CNA
- 2026-10-30 Priority changed: LOW → MEDIUM
- 2026-10-30 Fix available: RHSA-2006:0661 · Red Hat
- 2026-10-30 Fix available: RHSA-2007:0072 · Red Hat
- 2026-10-30 Fix available: RHSA-2007:0062 · Red Hat
- 2026-10-30 Fix available: RHSA-2007:0073 · Red Hat
- 2026-10-30 Fix available: Red Hat Desktop version 3, Red Hat Enterprise Linux AS version 3, Red Hat Enterprise Linux AS version 4 +9 · Red Hat
References
Patch 4
Advisory 8
Other 117
- http://dev2dev.bea.com/pub/advisory/238
- http://docs.info.apple.com/article.html?artnum=304829
- http://docs.info.apple.com/article.html?artnum=307177
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01070495
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771
- http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540
- http://jvn.jp/en/jp/JVN51615542/index.html
- http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000079.html
- http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
- http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
- http://lists.vmware.com/pipermail/security-announce/2008/000008.html
- http://marc.info/?l=bind-announce&m=116253119512445&w=2
- http://marc.info/?l=bugtraq&m=130497311408250&w=2
- http://openvpn.net/changelog.html
- http://security.freebsd.org/advisories/FreeBSD-SA-06:19.openssl.asc
- http://security.gentoo.org/glsa/glsa-200609-05.xml
- http://security.gentoo.org/glsa/glsa-200609-18.xml
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.566955
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.605306
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102656-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102657-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102686-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102696-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102722-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102744-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102759-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200708-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201247-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201534-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000148.1-1
- http://support.attachmate.com/techdocs/2127.html
- http://support.attachmate.com/techdocs/2128.html
- http://support.attachmate.com/techdocs/2137.html
- http://support.avaya.com/elmodocs2/security/ASA-2006-188.htm
- http://www.arkoon.fr/upload/alertes/40AK-2006-04-FR-1.1_SSL360_OPENSSL_RSA.pdf
- http://www.bluecoat.com/support/knowledge/openSSL_RSA_Signature_forgery.html
- http://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html
- http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml
- http://www.gentoo.org/security/en/glsa/glsa-200610-06.xml
- http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
- http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html
- http://www.kb.cert.org/vuls/id/845620
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:161
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:177
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:178
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:207
- http://www.matasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhere/
- http://www.novell.com/linux/security/advisories/2006_26_sr.html
- http://www.novell.com/linux/security/advisories/2006_55_ssl.html
- http://www.novell.com/linux/security/advisories/2006_61_opera.html
- http://www.novell.com/linux/security/advisories/2007_10_ibmjava.html
- http://www.openbsd.org/errata.html
- http://www.openoffice.org/security/cves/CVE-2006-4339.html
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.018.html
- http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.029-bind.html
- http://www.opera.com/support/search/supsearch.dml?index=845
- http://www.oracle.com/technetwork/topics/security/cpujan2007-101493.html
- http://www.osvdb.org/28549
- http://www.redhat.com/support/errata/RHSA-2007-0062.html
- http://www.redhat.com/support/errata/RHSA-2007-0072.html
- http://www.redhat.com/support/errata/RHSA-2007-0073.html
- http://www.redhat.com/support/errata/RHSA-2008-0629.html
- http://www.serv-u.com/releasenotes/
- http://www.sybase.com/detail?id=1047991
- http://www.us-cert.gov/cas/techalerts/TA06-333A.html
- http://www.vmware.com/security/advisories/VMSA-2008-0005.html
- http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
- http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html
- http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html
- http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html
- http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html
- http://www.vmware.com/support/player/doc/releasenotes_player.html
- http://www.vmware.com/support/player2/doc/releasenotes_player2.html
- http://www.vmware.com/support/server/doc/releasenotes_server.html
- http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html
- http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html
- http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html
- http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
- http://www.vupen.com/english/advisories/2006/3453
- http://www.vupen.com/english/advisories/2006/3566
- http://www.vupen.com/english/advisories/2006/3730
- http://www.vupen.com/english/advisories/2006/3748
- http://www.vupen.com/english/advisories/2006/3793
- http://www.vupen.com/english/advisories/2006/3899
- http://www.vupen.com/english/advisories/2006/3936
- http://www.vupen.com/english/advisories/2006/4205
- http://www.vupen.com/english/advisories/2006/4206
- http://www.vupen.com/english/advisories/2006/4207
- http://www.vupen.com/english/advisories/2006/4216
- http://www.vupen.com/english/advisories/2006/4327
- http://www.vupen.com/english/advisories/2006/4329
- http://www.vupen.com/english/advisories/2006/4366
- http://www.vupen.com/english/advisories/2006/4417
- http://www.vupen.com/english/advisories/2006/4586
- http://www.vupen.com/english/advisories/2006/4744
- http://www.vupen.com/english/advisories/2006/4750
- http://www.vupen.com/english/advisories/2006/5146
- http://www.vupen.com/english/advisories/2007/0254
- http://www.vupen.com/english/advisories/2007/0343
- http://www.vupen.com/english/advisories/2007/1401
- http://www.vupen.com/english/advisories/2007/1815
- http://www.vupen.com/english/advisories/2007/1945
- http://www.vupen.com/english/advisories/2007/2163
- http://www.vupen.com/english/advisories/2007/2315
- http://www.vupen.com/english/advisories/2007/2783
- http://www.vupen.com/english/advisories/2007/4224
- http://www.vupen.com/english/advisories/2008/0905/references
- http://www.vupen.com/english/advisories/2010/0366
- http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00771742
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117
- https://access.redhat.com/security/cve/CVE-2006-4339
- https://issues.rpath.com/browse/RPL-1633
- https://issues.rpath.com/browse/RPL-616
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11656
- https://secure-support.novell.com/KanisaPlatform/Publishing/41/3143224_f.SAL_Public.html
- https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2006-4339 · CVE Program
- CVE-2006-4339 · NVD
- FIRST EPSS
- GHSA-cw9v-mmf8-gmmr · GitHub Advisory Database · CC BY 4.0
- CVE-2006-4339 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences