PT-2018-3465 · Strongswan+3 · Strongswan+3
Sze Yiu Chau
·
Publicado
2018-09-24
·
Atualizado
2025-12-03
·
CVE-2018-16151
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions:
strongSwan versions 4.x through 5.x before 5.7.0
Description:
The issue is related to the verify emsa pkcs1 signature() function in the gmp plugin, which does not correctly verify cryptographic signatures. This can allow a remote attacker to forge signatures when small public exponents are used, potentially leading to impersonation when only an RSA signature is used for IKEv2 authentication.
Recommendations:
For strongSwan versions 4.x through 5.x before 5.7.0, update to version 5.7.0 or later to resolve the issue.
As a temporary workaround, consider restricting the use of small public exponents in RSA signatures until a patch is available.
Correção
Improper Verification of Cryptographic Signature
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Ubuntu
Strongswan