PT-2018-13428

Name of the Vulnerable Software and Affected Versions axTLS versions 2.1.3 and earlier Description The issue concerns the PKCS1 v1.5 signature verification in the sig verify function, which does not properly handle excess data after the hash value. This allows a remote attacker to forge signature...

PT-2018-13427

Name of the Vulnerable Software and Affected Versions axTLS version 2.1.3 and earlier Description The issue concerns the sig verify function in x509.c, where the PKCS1 v1.5 signature verification process blindly trusts the declared lengths in the ASN.1 structure. This can be exploited by a remote...