nspr, nss:weak hash signatures
| Package(s): | nspr, nss |
CVE #(s): | CVE-2009-2409
|
| Created: | July 31, 2009 |
Updated: | April 28, 2010 |
| Description: |
From the Red Hat advisory:
Dan Kaminsky found that browsers still accept certificates with MD2 hash
signatures, even though MD2 is no longer considered a cryptographically
strong algorithm. This could make it easier for an attacker to create a
malicious certificate that would be treated as trusted by a browser. NSS
now disables the use of MD2 and MD4 algorithms inside signatures by
default. (CVE-2009-2409)
|
| Alerts: |
|
