Re: CVE Request -- Ruby (OpenSSL extension) -- Insecure way of creation exponent value by private RSA key generation

[Kurt Seifried <kseifried () redhat com>]

On 11/07/2011 08:55 AM, Jan Lieskovsky wrote:
> Hello Kurt, Steve, vendors,
>
>   a security flaw was found in the way the OpenSSL extension of the
> Ruby programming language (of version from the Git trunk repository
> after 2011-09-01 up to 2011-11-03) generated exponent value to be used
> for private RSA key generation (the bug caused the exponent for the
> generated key to be always '1'). A remote attacker could use this flaw
> to bypass / corrupt integrity of services, depending on strong private
> RSA keys generation mechanism.
>
> Relevant upstream patch:
> [1]
> http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=33633
>
> References:
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=751800
>
> Could you allocate a CVE id for this?
Please use CVE-2011-4121 for this issue.
> Thank you && Regards, Jan.
> -- 
> Jan iankko Lieskovsky / Red Hat Security Response Team


-- 

-Kurt Seifried / Red Hat Security Response Team