Lucene search

GoogleOSV:PYSEC-2016-10

HistoryJan 13, 2016 - 3:59 p.m.

PYSEC-2016-10

2016-01-1315:59:00

Google

osv.dev

0.004 Low

EPSS

Percentile

74.5%

JSON

The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

CPENameOperatorVersion
rsaeq3.1
rsaeq3.0.1
rsaeq3.1.1
rsaeq3.1.3
rsaeq3.2.3
rsaeq1.2
rsaeq1.3
rsaeq2.0
rsaeq3.2.1
rsaeq1.3.3

Name	Operator	Version
rsa	eq	3.1
rsa	eq	3.0.1
rsa	eq	3.1.1
rsa	eq	3.1.3
rsa	eq	3.2.3
rsa	eq	1.2
rsa	eq	1.3
rsa	eq	2.0
rsa	eq	3.2.1
rsa	eq	1.3.3

Rows per page:

1-10 of 181

References

lists.fedoraproject.org/pipermail/package-announce/2016-January/175897.html

lists.fedoraproject.org/pipermail/package-announce/2016-January/175942.html

lists.opensuse.org/opensuse-updates/2016-01/msg00032.html

www.openwall.com/lists/oss-security/2016/01/05/1

www.openwall.com/lists/oss-security/2016/01/05/3

www.securityfocus.com/bid/79829

bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by/diff

blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/

0.004 Low

EPSS

Percentile

74.5%

JSON

Related for OSV:PYSEC-2016-10