864236 – (CVE-2013-2228) VUL-0: CVE-2013-2228: salt: RSA exponent set to 1

Bug 864236 (CVE-2013-2228) - VUL-0: CVE-2013-2228: salt: RSA exponent set to 1

Summary: VUL-0: CVE-2013-2228: salt: RSA exponent set to 1

Status:	RESOLVED FIXED

Alias:	CVE-2013-2228

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other openSUSE 13.1

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assignee:	Sascha Peilicke
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/96255/
Whiteboard:
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2014-02-17 08:52 UTC by Victor Pereira
Modified:	2014-06-20 08:54 UTC (History)
CC List:	2 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Victor Pereira 2014-02-17 08:52:33 UTC

CVE-2013-2228

when calling the method RSA.gen_key, the exponent to RSA was set to 1. It should be set at least for 3.


References:
http://marc.info/?l=oss-security&m=137264645602929&w=2
http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-2228.html
https://github.com/saltstack/salt/commit/5dd304276ba5745ec21fc1e6686a0b28da29e6fc
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2228

Comment 1 Swamp Workflow Management 2014-02-17 23:00:18 UTC

bugbot adjusting priority

Comment 2 Marcus Meissner 2014-06-20 08:54:43 UTC

cross checked opensuse 13.1, the exponent is 65537 there, so already fixed.