CVE-2018-15836
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2018-15836
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-15836.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2018-15836
- Published
- 2018-09-26T21:29:00.913Z
- Modified
- 2025-11-14T07:53:27.292356Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In verifysignedhash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.
- References
Affected packages
Git / github.com/xelerance/openswan
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xelerance/openswan
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
2.*
2.4.4
v2.*
v2.5.01
v2.5.03
v2.5.05
v2.5.08
v2.5.09
v2.5.10
v2.5.11
v2.5.12
v2.5.13
v2.5.14
v2.5.15
v2.5.16
v2.5.17
v2.6.01
v2.6.02
v2.6.03
v2.6.04
v2.6.05
v2.6.06
v2.6.07
v2.6.08
v2.6.09
v2.6.10
v2.6.11
v2.6.12
v2.6.13
v2.6.14
v2.6.15
v2.6.16
v2.6.17
v2.6.18
v2.6.19
v2.6.20
v2.6.21
v2.6.22
v2.6.23
v2.6.24
v2.6.25
v2.6.26
v2.6.27
v2.6.28
v2.6.29
v2.6.30
v2.6.31
v2.6.32
v2.6.33
v2.6.34
v2.6.35
v2.6.36
v2.6.37
v2.6.38
v2.6.40
v2.6.41
v2.6.42
v2.6.43
v2.6.44
v2.6.45
v2.6.46
v2.6.47
v2.6.47.1
v2.6.48
v2.6.49
v2.6.49.1
v2.6.50
Database specific
vanir_signatures
[
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2018-15836-1ac51d67",
"digest": {
"length": 900.0,
"function_hash": "236529740792023782679289609660264815960"
},
"source": "https://github.com/xelerance/openswan/commit/9eaa6c2a823c1d2b58913506a15f9474bf857a3d",
"signature_version": "v1",
"target": {
"function": "verify_signed_hash",
"file": "lib/liboswkeys/signatures.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2018-15836-2d94594d",
"digest": {
"line_hashes": [
"257282234818150788343041657178393295120",
"142560450995371773859260608519618091601",
"96950459911695153985521605877857233650",
"81033830470151624835191227279492282264"
],
"threshold": 0.9
},
"source": "https://github.com/xelerance/openswan/commit/9eaa6c2a823c1d2b58913506a15f9474bf857a3d",
"signature_version": "v1",
"target": {
"file": "lib/liboswkeys/signatures.c"
}
}
]