CVE-2011-4121 The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use th...
CriticalCVSS 9.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | >= 1.8.7.334, < 1.9.3 | 1.9.3 |
| OpenSSL extension of Ruby (Git trunk) | = versions after 2011-09-01 up to 2011-11-03 | No fix listed |
References
- www.openwall.com mailing-list third-party-advisory
- access.redhat.com third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- security-tracker.debian.org third-party-advisory