GitHub Advisoryadvisory · PyPI

GHSA-8rjr-6qq5-pj9p Python RSA allows attackers to spoof signatures

MEDIUM Published 2022-05-14 Modified 2024-10-21 Official page ↗
Aliases
CVE-2016-1494
Ecosystem
PyPI
Packages
rsa
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20, CWE-347
Reviewed
2023-07-28

Affected packages

• PyPI rsa: < 3.3 → fixed in 3.3

Description

The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

Related

Alias · CVE (1)

  • CVE-2016-1494 The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References