/ 
Crypt-OpenSSL-RSA-0.32
River stage three • 60 direct dependents • 118 total dependents
⭐ Starred 8 GitHub stars
Security Advisories (1)
CVE-2024-2467 (2024-04-25)

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.

Changes for version 0.32

  • Prefix internal bn2sv function so it doesn't collide with Net::SSLeay
  • Ensure that verify() leaves openssl error stack clean on failure
  • Fixed broken SEE ALSO links.
  • prevent outer $SIG{__DIE__} handler from being called during optional require.
  • omit done_testing since it does not work for older perl versions

Modules

Crypt::OpenSSL::RSA
RSA encoding and decoding, using the openSSL libraries

Other files