yt-dlp

Wykres commitów

Autor	SHA1	Wiadomość	Data
Unknown	cefecac12c	[skip travis] renaming to avoid using same folder when using pip install for example	2020-09-02 20:25:25 +02:00
Filippo Valsorda	4d318be195	[update] fix (unexploitable) BB'06 vulnerability in rsa_verify The rsa_verify code was vulnerable to a BB'06 attack, allowing to forge signatures for arbitrary messages if and only if the public key exponent is 3. Since the updates key is hardcoded to 65537, there is no risk for youtube-dl, but I don't want vulnerable code in the wild. The new function adopts a way safer approach of encoding-and-comparing to replace the dangerous parsing code.	2016-01-21 20:12:17 +00:00

Autor

SHA1

Wiadomość

Data

Unknown

cefecac12c

[skip travis] renaming

to avoid using same folder when using pip install for example

2020-09-02 20:25:25 +02:00

Filippo Valsorda

4d318be195

[update] fix (unexploitable) BB'06 vulnerability in rsa_verify

The rsa_verify code was vulnerable to a BB'06 attack, allowing to forge
signatures for arbitrary messages if and only if the public key exponent is
3.  Since the updates key is hardcoded to 65537, there is no risk for
youtube-dl, but I don't want vulnerable code in the wild.

The new function adopts a way safer approach of encoding-and-comparing to
replace the dangerous parsing code.

2016-01-21 20:12:17 +00:00

2 Commity (e8d46fc979eb17856a10dd91024c7cee7ae3a397)