CVE-2005-2946: High severity OpenSSL OpenSSL vulnerability

Q: What is the severity of CVE-2005-2946?

CVE-2005-2946 is considered a high severity vulnerability due to the potential for certificate forgery.

Q: How do I fix CVE-2005-2946?

To fix CVE-2005-2946, upgrade OpenSSL to version 0.9.8 or later where a stronger hashing algorithm is used.

Q: Which versions of OpenSSL are affected by CVE-2005-2946?

CVE-2005-2946 affects OpenSSL versions earlier than 0.9.8, including all versions from 0.9.1c to 0.9.7g.

Q: What type of attack is associated with CVE-2005-2946?

CVE-2005-2946 can enable remote attackers to forge certificates, thereby potentially compromising secure communications.

Q: Is there a workaround for CVE-2005-2946 if I cannot update OpenSSL?

If updating is not an option, consider using external validation of certificates to reduce risk, but the best solution remains to upgrade to a secure version.

Published Sep 16, 2005

Updated

The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it easier for remote attackers to forge certificates with a valid certificate authority signature.

Affected Software

48 affected components

OpenSSL OpenSSL=0.9.7-beta5

OpenSSL OpenSSL=0.9.7-beta3

OpenSSL OpenSSL=0.9.5a-beta2

OpenSSL OpenSSL=0.9.7-beta6

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.3

OpenSSL OpenSSL=0.9.7-beta2

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=0.9.5-beta1

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.6a-beta2

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.6-beta3

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.6a-beta1

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.6-beta2

OpenSSL OpenSSL=0.9.7-beta4

OpenSSL OpenSSL=0.9.3a

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.7-beta1

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6-beta1

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.5-beta2

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.5a-beta1

OpenSSL OpenSSL=0.9.6a-beta3

OpenSSL OpenSSL=0.9.7f

OpenSSL OpenSSL<0.9.8

Ubuntu=4.10

Ubuntu=5.04

Event History

Sep 16, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2946?

CVE-2005-2946 is considered a high severity vulnerability due to the potential for certificate forgery.

How do I fix CVE-2005-2946?

To fix CVE-2005-2946, upgrade OpenSSL to version 0.9.8 or later where a stronger hashing algorithm is used.

Which versions of OpenSSL are affected by CVE-2005-2946?