full-disclosure - [OpenSSL Advisory] Vulnerabilities in ASN.1 parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: fw at deneb.enyo.de (Florian Weimer)
Subject: [OpenSSL Advisory] Vulnerabilities in ASN.1 parsing

On Tue, Sep 30, 2003 at 03:27:50PM +0100, Mark J Cox wrote:

> Who is affected?
> - ----------------
> 
> All versions of OpenSSL up to and including 0.9.6j and 0.9.7b and all
> versions of SSLeay are affected.
> 
> Any application that makes use of OpenSSL's ASN1 library to parse
> untrusted data. This includes all SSL or TLS applications, those using
> S/MIME (PKCS#7) or certificate generation routines.

Does verifying a RSA signature also count?  IIRC the ASN.1 parser is
invoked during the process (to check the padding).