/ 
Crypt-OpenSSL-RSA-0.33
River stage three • 60 direct dependents • 118 total dependents
⭐ Starred 8 GitHub stars
Security Advisories (1)
CVE-2024-2467 (2024-04-25)

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.

Changes for version 0.33

  • Update for windows github CI
  • Remove duplicit 'LICENSE' key
  • Remove EUMM Remove version check
  • #31 by removing reference to RSA_SSLV23_PADDING (removed from OpenSSL starting from v3.0.0)
  • support passphase protected private key load
  • fix 'unsupported encryption' error on old library versions
  • Clarify croak message for missing passphrase on older cyphers
  • More structs opaqued in LibreSSL 3.5
  • Use a macro for dealing with older SSL lacking macros
  • more CI fixups. Drop testing for 5.10 and 5.8. Something is broken upstream.

Modules

Crypt::OpenSSL::RSA
RSA encoding and decoding, using the openSSL libraries

Other files