CVE-2000-1254 crypto/rsa/rsa_gen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection....
HighCVSS 7.5
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
crypto/rsa/rsa_gen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging improper RSA key generation on 64-bit HP-UX platforms.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssl(Debian:12) | < 0.9.6-1 | 0.9.6-1 |
| debian/openssl(Debian:13) | < 0.9.6-1 | 0.9.6-1 |
| debian/openssl(Debian:14) | < 0.9.6-1 | 0.9.6-1 |
| OpenSSL | <= 0.9.5 | No fix listed |
References
- Debian Security Tracker CVE-2000-1254 vendor-advisory
- [openssl-users] 20000529 64 bit problem in RSA_generate_key in 0.9.5a mailing-list
- www-01.ibm.com
- [oss-security] 20160504 broken RSA keys mailing-list
- 90109 vdb-entry
- 1035750 vdb-entry
- git.openssl.org