CVE-2018-16149 in axTLS

Resumen (Inglés)

In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponents are being used, a remote attacker can generate purposefully crafted signatures (and put them on X.509 certificates) to induce illegal memory access and crash the verifier.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Reservar

2018-08-29

Divulgación

2018-11-07

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
126520	axTLS ASN.1 x509.c sig_verify autenticación débil	347	No está definido	Arreglo oficial	CVE-2018-16149

Fuentes

• MITRE
• NVD
• CVE Details