CVE-2018-15836

In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during…

published September 26, 2018

CVSS
—
EPSS
2%
Percentile
74.4
In the wild
Unconfirmed
What it is

In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01522 · 74.4th percentile
Published
2018-09-26T21:00Z
EPSS history
Timeline
  • 26 SEP 21:00Z
    In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during…
    cvelistv5