/ 
Crypt-OpenSSL-RSA-0.17
River stage three • 60 direct dependents • 118 total dependents
Security Advisories (1)
CVE-2024-2467 (2024-04-25)

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.

Changes for version 0.17

  • Workaround for gcc 3.2 compile problems: "/usr/include/openssl/des.h:193: parse error before '&' token" (Patch by Rob Brown <bbb@cpan.org>)
  • Deprecate no-arg constructor, load_*_key methods and the instance method generate_key; switch to three constructors: new_public_key, new_private_key and generate_key (as a class method)
  • Deprecate set_padding_mode method; replace with use_xxx_padding.
  • move tests into t directory, use Test as a framework

Modules

Crypt::OpenSSL::RSA
RSA encoding and decoding, using the openSSL libraries

Other files