CVE-2006-2940

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) public exponent or (2) public modulus values in X.509 certificates that require extra time to process when using RSA signature verification.

Affected Software

Name	Vendor	Start Version	End Version
Openssl	Openssl	0.9.5a	0.9.5a
Openssl	Openssl	0.9.8b	0.9.8b
Openssl	Openssl	0.9.6i	0.9.6i
Openssl	Openssl	0.9.3	0.9.3
Openssl	Openssl	0.9.8c	0.9.8c
Openssl	Openssl	0.9.7c	0.9.7c
Openssl	Openssl	0.9.5	0.9.5
Openssl	Openssl	0.9.6d	0.9.6d
Openssl	Openssl	0.9.1c	0.9.1c
Openssl	Openssl	0.9.6	0.9.6
Openssl	Openssl	0.9.7j	0.9.7j
Openssl	Openssl	0.9.6a	0.9.6a
Openssl	Openssl	0.9.4	0.9.4
Openssl	Openssl	0.9.6a	0.9.6a
Openssl	Openssl	0.9.5a	0.9.5a
Openssl	Openssl	0.9.6f	0.9.6f
Openssl	Openssl	0.9.6	0.9.6
Openssl	Openssl	0.9.6l	0.9.6l
Openssl	Openssl	0.9.7k	0.9.7k
Openssl	Openssl	0.9.7g	0.9.7g
Openssl	Openssl	0.9.6e	0.9.6e
Openssl	Openssl	0.9.7d	0.9.7d
Openssl	Openssl	0.9.7	0.9.7
Openssl	Openssl	0.9.6b	0.9.6b
Openssl	Openssl	0.9.7e	0.9.7e
Openssl	Openssl	0.9.7b	0.9.7b
Openssl	Openssl	0.9.6a	0.9.6a
Openssl	Openssl	0.9.6k	0.9.6k
Openssl	Openssl	0.9.8a	0.9.8a
Openssl	Openssl	0.9.6g	0.9.6g
Openssl	Openssl	0.9.6	0.9.6
Openssl	Openssl	0.9.3a	0.9.3a
Openssl	Openssl	0.9.6h	0.9.6h
Openssl	Openssl	0.9.7i	0.9.7i
Openssl	Openssl	0.9.7h	0.9.7h
Openssl	Openssl	0.9.6j	0.9.6j
Openssl	Openssl	0.9.8	0.9.8
Openssl	Openssl	0.9.7a	0.9.7a
Openssl	Openssl	0.9.6c	0.9.6c
Openssl	Openssl	0.9.6	0.9.6
Openssl	Openssl	0.9.6m	0.9.6m
Openssl	Openssl	0.9.5	0.9.5
Openssl	Openssl	0.9.2b	0.9.2b
Openssl	Openssl	0.9.5	0.9.5
Openssl	Openssl	0.9.5a	0.9.5a
Openssl	Openssl	0.9.6a	0.9.6a
Openssl	Openssl	0.9.7f	0.9.7f

NVD	https://nvd.nist.gov/vuln/detail/CVE-2006-2940
CWE	https://cwe.mitre.org/data/definitions/399.html

Affected Software

References