Klima-Pokorny-Rosa attack on PKCS #1 v1.5 padding

On some conditions it's possible server's private key to be applied to attacker choosen ciphertext...