CVE-2018-16151

In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded algorithm OID during PKCS#1 v1.5 signature verification. Similar to the flaw in the same version of strongSwan regarding digestAlgorithm.parameters, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*
cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

History

No history.

Information

Published : 2018-09-26 21:29

Updated : 2019-12-01 01:15


NVD link : CVE-2018-16151

Mitre link : CVE-2018-16151


JSON object : View

Products Affected

canonical

  • ubuntu_linux

strongswan

  • strongswan

debian

  • debian_linux
CWE
CWE-347

Improper Verification of Cryptographic Signature