CVE-2016-6298 - OpenCVE

The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Latchset	Jwcrypto

Configuration 1 [-]

cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/92729
https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba
https://github.com/latchset/jwcrypto/issues/65
https://github.com/latchset/jwcrypto/pull/66
https://github.com/latchset/jwcrypto/releases/tag/v0.3.2

History

Fri, 01 Nov 2024 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Latchset Latchset jwcrypto
CPEs	cpe:2.3:a:jwcrypto_project:jwcrypto::::::::	cpe:2.3:a:latchset:jwcrypto::::::::
Vendors & Products	Jwcrypto Project Jwcrypto Project jwcrypto	Latchset Latchset jwcrypto
Metrics	cvssV3_0 `{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2016-09-01T23:00:00

Updated: 2024-08-06T01:22:20.877Z

Reserved: 2016-07-26T00:00:00

Link: CVE-2016-6298

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2016-09-01T23:59:01.160

Modified: 2024-11-01T14:36:23.500

Link: CVE-2016-6298

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-08-31T00:00:00", "descriptions": [{"lang": "en", "value": "The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-25T19:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/latchset/jwcrypto/issues/65"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/latchset/jwcrypto/pull/66"}, {"name": "92729", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/92729"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/latchset/jwcrypto/releases/tag/v0.3.2"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2016-6298", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/latchset/jwcrypto/issues/65", "refsource": "CONFIRM", "url": "https://github.com/latchset/jwcrypto/issues/65"}, {"name": "https://github.com/latchset/jwcrypto/pull/66", "refsource": "CONFIRM", "url": "https://github.com/latchset/jwcrypto/pull/66"}, {"name": "92729", "refsource": "BID", "url": "http://www.securityfocus.com/bid/92729"}, {"name": "https://github.com/latchset/jwcrypto/releases/tag/v0.3.2", "refsource": "CONFIRM", "url": "https://github.com/latchset/jwcrypto/releases/tag/v0.3.2"}, {"name": "https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba", "refsource": "CONFIRM", "url": "https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T01:22:20.877Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/latchset/jwcrypto/issues/65"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/latchset/jwcrypto/pull/66"}, {"name": "92729", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/92729"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/latchset/jwcrypto/releases/tag/v0.3.2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2016-6298", "datePublished": "2016-09-01T23:00:00", "dateReserved": "2016-07-26T00:00:00", "dateUpdated": "2024-08-06T01:22:20.877Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*", "matchCriteriaId": "3D621897-7527-4674-BC69-A6C1C2D76D49", "versionEndExcluding": "0.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA)."}, {"lang": "es", "value": "La clase _Rsa15 en la implementaci\u00f3n de algoritmo RSA 1.5 en jwa.py en jwcrypto en versiones anteriores a 0.3.2 carece del mecanismo de protecci\u00f3n Random Filling, lo que facilita a atacantes remotos obtener datos en texto plano a trav\u00e9s de un Million Message Attack (MMA)."}], "id": "CVE-2016-6298", "lastModified": "2024-11-01T14:36:23.500", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-09-01T23:59:01.160", "references": [{"source": "secalert@redhat.com", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/92729"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://github.com/latchset/jwcrypto/issues/65"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/latchset/jwcrypto/pull/66"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/latchset/jwcrypto/releases/tag/v0.3.2"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}