CVE-2006-4790

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-09-14 · updated 2026-06-16

Description

verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents GnuTLS from correctly verifying X.509 and other certificates that use PKCS, a variant of CVE-2006-4339.

Affected products

[UNKNOWN] gnutls: 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.22 (+34)

References

http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html
http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001212.html
http://secunia.com/advisories/21937
http://secunia.com/advisories/21942
http://secunia.com/advisories/21973
http://secunia.com/advisories/22049
http://secunia.com/advisories/22080
http://secunia.com/advisories/22084
http://secunia.com/advisories/22097
http://secunia.com/advisories/22226
http://secunia.com/advisories/22992
http://secunia.com/advisories/25762

Get alerted when CVE-2006-4790 or the next vulnerability affects your stack