/ 
Crypt-OpenSSL-RSA-0.13
River stage three • 60 direct dependents • 118 total dependents
Security Advisories (1)
CVE-2024-2467 (2024-04-25)

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.

Changes for version 0.13

  • Incorporating patch from Matthias Bauer <bauerm@immd1.informatik.uni-erlangen.de>, which provides signing and verification, as well as uses OpenSSL's internal error reporting system. This patch also fixes a bug with the RSA_NO_PADDING_MODE. Thanks, Matthias!
  • Deprecate set_padding_mode in favor of use_xxx_padding.
  • Rather than returning true on success, false on failure, just croak when there are problems.
  • Plug memory leaks.
  • Fix my email address (it's cpan.org, not cpan.com)

Modules

Crypt::OpenSSL::RSA
RSA encoding and decoding, using the openSSL libraries

Other files