jwcrypto lacks the Random Filling protection mechanism
The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-6298US | medium5.3 | — | ||
The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attacker… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/latchset/jwcryptoPACKAGE
- https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7baWEB
- https://github.com/latchset/jwcrypto/issues/65WEB
- https://github.com/latchset/jwcrypto/pull/66WEB
- https://github.com/latchset/jwcrypto/releases/tag/v0.3.2WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/jwcrypto/PYSEC-2016-4.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2016-6298ADVISORY
- https://web.archive.org/web/20200227230613/http://www.securityfocus.com/bid/92729WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan