Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Aug 2015 11:06:10 -0600
From: Kurt Seifried <>
To: oss-security <>,
Subject: CVE request for saltstack

So someone pointed this out to me:

     priv = '{0}.pem'.format(base)
     pub = '{0}.pub'.format(base)

-    gen = RSA.gen_key(keysize, 1, callback=lambda x, y, z: None)
+    gen = RSA.gen_key(keysize, 65537, callback=lambda x, y, z: None)
     cumask = os.umask(191)
     gen.save_key(priv, None)

This is using the M2Crypto.RSA.

TL;DR: doing RSA crypto with a public exponent value of "1" makes crypto
very fast. Fast is not always good.

Can we get a CVE for this please?


Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact:

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ