CVE-2006-4339
criticalA flaw was found in OpenSSL.
Vendor / product: Openssl — openssl
A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (secalert@redhat.com)
Timeline (UTC)
Published: 2006-09-05 17:04
Modified: 2026-10-30 17:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-11-03 07:33 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
openssl / openssl ≤0.9.7, 0.9.1c, 0.9.2b, 0.9.3, 0.9.3a, 0.9.4
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: http://secunia.com/advisories/21709
Vendor advisory: http://secunia.com/advisories/21767
Vendor advisory: http://secunia.com/advisories/21776
Vendor advisory: http://secunia.com/advisories/21778
Vendor advisory: http://secunia.com/advisories/21785
Vendor advisory: http://secunia.com/advisories/21791
Vendor advisory: http://secunia.com/advisories/21812
Vendor advisory: http://secunia.com/advisories/21823
Vendor advisory: http://secunia.com/advisories/21846
Vendor advisory: http://secunia.com/advisories/21852
Patch / mitigation: http://secunia.com/advisories/21709
Patch / mitigation: http://www.debian.org/security/2006/dsa-1174
Patch / mitigation: http://www.openssl.org/news/secadv_20060905.txt
Patch / mitigation: http://www.securityfocus.com/bid/19849
Patch / mitigation: http://www.ubuntu.com/usn/usn-339-1
Patch / mitigation: http://www.us.debian.org/security/2006/dsa-1173
Patch / mitigation: http://secunia.com/advisories/21709
Patch / mitigation: http://www.debian.org/security/2006/dsa-1174
Patch / mitigation: http://www.openssl.org/news/secadv_20060905.txt
Patch / mitigation: http://www.securityfocus.com/bid/19849
References
- http://dev2dev.bea.com/pub/advisory/238 secalert@redhat.com
- http://docs.info.apple.com/article.html?artnum=304829 secalert@redhat.com
- http://docs.info.apple.com/article.html?artnum=307177 secalert@redhat.com
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c0107... secalert@redhat.com
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771 secalert@redhat.com
- http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540 secalert@redhat.com
- http://jvn.jp/en/jp/JVN51615542/index.html secalert@redhat.com
- http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000079.html secalert@redhat.com
- http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html secalert@redhat.com
- http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html secalert@redhat.com
- http://lists.vmware.com/pipermail/security-announce/2008/000008.html secalert@redhat.com
- http://marc.info/?l=bind-announce&m=116253119512445&w=2 secalert@redhat.com
- http://marc.info/?l=bugtraq&m=130497311408250&w=2 secalert@redhat.com
- http://openvpn.net/changelog.html secalert@redhat.com
- http://secunia.com/advisories/21709 secalert@redhat.com
- http://secunia.com/advisories/21767 secalert@redhat.com
- http://secunia.com/advisories/21776 secalert@redhat.com
- http://secunia.com/advisories/21778 secalert@redhat.com
- http://secunia.com/advisories/21785 secalert@redhat.com
- http://secunia.com/advisories/21791 secalert@redhat.com
- http://secunia.com/advisories/21812 secalert@redhat.com
- http://secunia.com/advisories/21823 secalert@redhat.com
- http://secunia.com/advisories/21846 secalert@redhat.com
- http://secunia.com/advisories/21852 secalert@redhat.com
- http://secunia.com/advisories/21870 secalert@redhat.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 07:33 UTC · record ↗