/ 
Crypt-OpenSSL-RSA-0.24
River stage three • 60 direct dependents • 118 total dependents
Security Advisories (1)
CVE-2024-2467 (2024-04-25)

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.

Changes for version 0.24

  • Fix a bug reported by Mark Martinec <Mark.Martinec@ijs.si> where encrypt could segfault if called with insufficient data; it now informatively croaks instead.
  • Fix a bug reported by Mark Martinec where check_key would segfault instead of croaking when called on a public key.
  • Fix decrypt and private_encrypt to croak instead of segfault when called on a public key.
  • Add an is_private method.
  • Silence a few compiler warnings about ignoring return values from certain BIO_* methods.

Modules

Crypt::OpenSSL::RSA
RSA encoding and decoding, using the openSSL libraries

Other files