---
title: "CVE-2006-2940\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2006-2940?format=md
keywords: index, follow
---

# CVE-2006-2940

Publication date 28 September 2006

Last updated 17 July 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions
allows attackers to cause a denial of service (CPU consumption) via
parasitic public keys with large (1) "public exponent" or (2) "public
modulus" values in X.509 certificates that require extra time to process
when using RSA signature verification.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| openssl | 7.04 feisty | Fixed 0.9.8b-2ubuntu2 |
| 6.10 edgy | Fixed 0.9.8b-2ubuntu2 |
| 6.06 LTS dapper | Fixed 0.9.8a-7ubuntu0.3 |
| openssl097 | 7.04 feisty | Fixed 0.9.7k-3 |
| 6.10 edgy | Fixed 0.9.7k-3 |
| 6.06 LTS dapper | Fixed 0.9.7g-5ubuntu1.1 |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2006-2940)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2006-2940)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2006-2940)

### Related Ubuntu Security Notices (USN)

+ [USN-353-1](https://usn.ubuntu.com/USN-353-1)
+ openssl vulnerabilities
+ 29 September 2006

+ [USN-353-2](https://usn.ubuntu.com/USN-353-2)
+ OpenSSL vulnerability
+ 5 October 2006

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2006-2940>