CVE-2018-15836
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2018-15836
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-15836.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2018-15836
- Published
- 2018-09-26T21:29:00Z
- Modified
- 2025-01-08T10:17:35.051432Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In verifysignedhash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.
- References
Affected packages
Git / github.com/xelerance/openswan
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xelerance/openswan
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixed
Affected versions
2.*
2.4.4
v2.*
v2.5.01
v2.5.03
v2.5.05
v2.5.08
v2.5.09
v2.5.10
v2.5.11
v2.5.12
v2.5.13
v2.5.14
v2.5.15
v2.5.16
v2.5.17
v2.6.01
v2.6.02
v2.6.03
v2.6.04
v2.6.05
v2.6.06
v2.6.07
v2.6.08
v2.6.09
v2.6.10
v2.6.11
v2.6.12
v2.6.13
v2.6.14
v2.6.15
v2.6.16
v2.6.17
v2.6.18
v2.6.19
v2.6.20
v2.6.21
v2.6.22
v2.6.23
v2.6.24
v2.6.25
v2.6.26
v2.6.27
v2.6.28
v2.6.29
v2.6.30
v2.6.31
v2.6.32
v2.6.33
v2.6.34
v2.6.35
v2.6.36
v2.6.37
v2.6.38
v2.6.40
v2.6.41
v2.6.42
v2.6.43
v2.6.44
v2.6.45
v2.6.46
v2.6.47
v2.6.47.1
v2.6.48
v2.6.49
v2.6.49.1
v2.6.50