CVE-2006-5484

2006-10-2422:07:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2006-5484

ssh tectia

rsa key

pkcs #1 v1.5

signature

x.509

certificate

nvd

security

9.5 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.02 Low

EPSS

Percentile

88.7%

JSON

SSH Tectia Client/Server/Connector 5.1.0 and earlier, Manager 2.2.0 and earlier, and other products, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents Tectia from correctly verifying X.509 and other certificates that use PKCS #1, a similar issue to CVE-2006-4339.

CPENameOperatorVersion
ssh:tectia_clientssh tectia clientle5.1.0
ssh:tectia_serverssh tectia serverle5.1.0
ssh:tectia_connectorssh tectia connectorle5.1.0
ssh:tectia_managerssh tectia managerle2.2.0

CPE	Name	Operator	Version
ssh:tectia_client	ssh tectia client	le	5.1.0
ssh:tectia_server	ssh tectia server	le	5.1.0
ssh:tectia_connector	ssh tectia connector	le	5.1.0
ssh:tectia_manager	ssh tectia manager	le	2.2.0