CVE-2005-2946

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it easier for remote attackers to forge certificates with a valid certificate authority signature.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.cits.rub.de/MD5Collisions/Broken Link
http://www.ubuntu.com/usn/usn-179-1Vendor Advisory
https://bugzilla.ubuntu.com/show_bug.cgi?id=13593Broken Link, Issue Tracking, Vendor Advisory
http://www.cits.rub.de/MD5Collisions/Broken Link
http://www.ubuntu.com/usn/usn-179-1Vendor Advisory
https://bugzilla.ubuntu.com/show_bug.cgi?id=13593Broken Link, Issue Tracking, Vendor Advisory

Timeline

Published: Sep 16, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-29475.1Buffer overflow in KillProcess 2.20 and earlier allows user-assisted attackers to execute arbitrary code via an exe file with a long FileDes CVE-2005-29482.1KillProcess 2.20 and earlier allows local users to bypass kill list restrictions by launching multiple processes at the same time, which are CVE-2005-29497.5pam_per_user before 0.4 does not verify if the user name changes between authentication attempts and uses the same subrequest handle, which CVE-2005-29504.3Cross-site scripting (XSS) vulnerability in Sawmill 7.0.0 through 7.1.13 allows remote attackers to inject arbitrary web script or HTML via CVE-2005-29517.5Directory traversal vulnerability in security.inc.php in AzDGDatingLite 2.1.3, and possibly earlier versions, allows remote attackers to exe CVE-2005-29525.0Directory traversal vulnerability in s.pl in Subscribe Me Pro 2.044.09P and earlier allows remote attackers to read arbitrary files via a ..CVE-2005-29534.3Cross-site scripting (XSS) vulnerability in merchant.mvc in MIVA Merchant 5 allows remote attackers to inject arbitrary web script or HTML v CVE-2005-29547.5SQL injection vulnerability in password_reminder.php in ATutor before 1.5.1 pl1 allows remote attackers to execute arbitrary SQL commands vi CVE-2005-29554.6config.inc.php in ATutor 1.5.1, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which al CVE-2005-29565.0ATutor 1.5.1, and possibly earlier versions, stores temporary chat logs under the web document root with insufficient access control and pre CVE-2005-29577.5Stack-based buffer overflow in AVIRA Desktop for Windows 1.00.00.68 with AVPACK32.DLL 6.31.0.3, when archive scanning is enabled, allows rem CVE-2005-29587.5Multiple format string vulnerabilities in the GNOME Data Access library for GNOME2 (libgda2) 1.2.1 and earlier allow attackers to execute ar