PT-2016-6819 · None · Jwcrypto

Dennis Detering · Published 2016-09-01 · Updated 2024-11-01 · CVE-2016-6298

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions jwcrypto versions prior to 0.3.2

Description The issue concerns the RSA 1.5 algorithm implementation in jwa.py, which lacks the Random Filling protection mechanism. This makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

Recommendations For versions prior to 0.3.2, update to version 0.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the RSA 1.5 algorithm implementation until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-6298

GHSA-WG33-X934-3GHH

PYSEC-2016-4

Affected Products

Jwcrypto

References · 18

• https://github.com/latchset/jwcrypto/issues/65 · Vendor Advisory
• https://github.com/latchset/jwcrypto/releases/tag/v0.3.2 · Vendor Advisory
• https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba · Vendor Advisory
• https://github.com/latchset/jwcrypto/pull/66 · Patch
• https://security-tracker.debian.org/tracker/CVE-2016-6298 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wg33-x934-3ghh · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6298 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6298 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-6298 · Security Note
• https://ubuntu.com/security/CVE-2016-6298 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6298 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2016-4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6298 · Security Note
• https://github.com/latchset/jwcrypto · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/jwcrypto/PYSEC-2016-4.yaml · Note