Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2018-16150
HistoryNov 07, 2018 - 8:29 p.m.

CVE-2018-16150

2018-11-0720:29:00
CWE-347
mitre
web.nvd.nist.gov
33
cve-2018-16150
sig_verify
x509.c
axtls
pkcs#1 v1.5
signature
verification
excess data
hash value
remote attacker
signature forgery
impersonation
x.509 certificates

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.4

Confidence

High

EPSS

0.264

Percentile

96.8%

JSON

In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509 certificates. This is a variant of CVE-2006-4340.

Affected configurations

Nvd
Node
axtls_projectaxtlsRange≤2.1.3
VendorProductVersionCPE
axtls_projectaxtlscpe:/a:axtls_project:axtls::::

Related

cvelist 3
prion 1
osv 4
debiancve 3
nvd 4
veracode 1
nessus 38
openvas 18
mozilla 1
gentoo 3
cve 3
ubuntucve 2
suse 2
debian 3
oraclelinux 3
centos 4
redhat 3
ubuntu 4
freebsd 1
cert 2
cvelist
cvelist
CVE-2018-16150
2018-11-07 20:00:00
CVE-2006-5462
2006-11-08 21:00:00
CVE-2006-4340
2006-09-15 18:00:00
prion
prion
Code injection
2018-11-07 20:29:00
osv
osv
CVE-2018-16150
2018-11-07 20:29:00
mozilla-firefox
2006-11-14 00:00:00
mozilla
2006-10-06 00:00:00
debiancve
debiancve
CVE-2018-16150
2018-11-07 20:29:00
CVE-2006-5462
2006-11-08 21:07:00
CVE-2006-4340
2006-09-15 18:07:00
nvd
nvd
CVE-2018-16150
2018-11-07 20:29:00
CVE-2006-4341
2006-09-11 19:04:00
CVE-2006-5462
2006-11-08 21:07:00
veracode
veracode
Spoofable SSL Certificate
2020-04-10 00:13:11
nessus
nessus
Fedora Core 5 : nss-3.11.3-0.5.fc5 (2006-979)
2007-01-17 00:00:00
openSUSE 10 Security Update : mozilla-nss (mozilla-nss-2071)
2007-10-17 00:00:00
SuSE 10 Security Update : mozilla-nss,mozilla-nss-devel (ZYPP Patch Number 2067)
2007-12-13 00:00:00
openvas
openvas
Gentoo Security Advisory GLSA 200610-06 (nss)
2008-09-24 00:00:00
Gentoo Security Advisory GLSA 200610-06 (nss)
2008-09-24 00:00:00
Debian Security Advisory DSA 1210-1 (mozilla-firefox)
2008-01-17 00:00:00
mozilla
mozilla
RSA Signature Forgery — Mozilla
2006-09-14 00:00:00
gentoo
gentoo
Mozilla Network Security Service (NSS): RSA signature forgery
2006-10-17 00:00:00
Mozilla Thunderbird: Multiple vulnerabilities
2006-10-04 00:00:00
Mozilla Firefox: Multiple vulnerabilities
2006-09-28 00:00:00
cve
cve
CVE-2006-4341
2006-09-11 19:04:00
CVE-2006-5462
2006-11-08 21:07:00
CVE-2006-4340
2006-09-15 18:07:00
ubuntucve
ubuntucve
CVE-2006-5462
2006-11-08 00:00:00
CVE-2006-4340
2006-09-15 00:00:00
suse
suse
RSA signature evasion in openssl,mozilla-nss
2006-09-22 15:25:59
remote code execution in MozillaFirefox,MozillaThunderbird,seamonkey
2006-09-22 13:02:47
debian
debian
[SECURITY] [DSA 1210-1] New Mozilla Firefox packages fix several vulnerabilities
2006-11-14 08:02:35
[SECURITY] [DSA 1192-1] New Mozilla packages fix several vulnerabilities
2006-10-06 12:11:15
[SECURITY] [DSA 1191-1] New Mozilla Thunderbird packages fix several vulnerabilities
2006-10-05 10:14:30
oraclelinux
oraclelinux
Critical seamonkey security update
2006-12-07 00:00:00
Critical thunderbird security update
2006-12-07 00:00:00
Critical firefox security update
2006-12-07 00:00:00
centos
centos
thunderbird security update
2006-09-15 14:57:35
seamonkey security update
2006-09-17 23:20:54
devhelp, seamonkey security update
2006-09-15 14:57:11
redhat
redhat
(RHSA-2006:0677) thunderbird security update
2006-09-15 00:00:00
(RHSA-2006:0676) seamonkey security update
2006-09-15 00:00:00
(RHSA-2006:0675) firefox security update
2006-09-15 00:00:00
ubuntu
ubuntu
Thunderbird vulnerabilities
2006-09-25 00:00:00
firefox vulnerabilities
2006-09-23 00:00:00
Mozilla vulnerabilities
2006-10-10 00:00:00
freebsd
freebsd
mozilla -- multiple vulnerabilities
2006-09-14 00:00:00
cert
cert
OpenSSL SSL_get_shared_ciphers() vulnerable to buffer overflow
2006-09-28 00:00:00
OpenSSL SSLv2 client code fails to properly check for NULL
2006-09-28 00:00:00

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.4

Confidence

High

EPSS

0.264

Percentile

96.8%

JSON
Related for CVE-2018-16150
cvelist3prion1osv4debiancve3nvd4veracode1nessus38openvas18mozilla1gentoo3cve3ubuntucve2suse2debian3oraclelinux3centos4redhat3ubuntu4freebsd1cert2