Security Advisories (1)
CVE-2009-0129 (2009-01-15)

Missing error check in do_verify, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature.

Changes for version 0.12

  • Removed all use of strlen() in DSA.xs so signatures with nulls, as commonly generated with sha1, could be signed/verified, and added more tests (Brad Fitzpatrick <brad@danga.com>)

Documentation

Digital Signature Object

Modules

Digital Signature Algorithm using OpenSSL