Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 07 Nov 2011 09:13:57 -0700
From: Kurt Seifried <>
CC: Jan Lieskovsky <>,
        "Steven M. Christey" <>
Subject: Re: CVE Request -- Ruby (OpenSSL extension) -- Insecure
 way of creation exponent value by private RSA key generation

On 11/07/2011 08:55 AM, Jan Lieskovsky wrote:
> Hello Kurt, Steve, vendors,
>   a security flaw was found in the way the OpenSSL extension of the
> Ruby programming language (of version from the Git trunk repository
> after 2011-09-01 up to 2011-11-03) generated exponent value to be used
> for private RSA key generation (the bug caused the exponent for the
> generated key to be always '1'). A remote attacker could use this flaw
> to bypass / corrupt integrity of services, depending on strong private
> RSA keys generation mechanism.
> Relevant upstream patch:
> [1]
> References:
> [2]
> Could you allocate a CVE id for this?
Please use CVE-2011-4121 for this issue.
> Thank you && Regards, Jan.
> -- 
> Jan iankko Lieskovsky / Red Hat Security Response Team


-Kurt Seifried / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.