CVE-2016-6298

Description

The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

Risk Information

Base Score

5.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.365

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2016-6298 are fixed in Python-jwcrypto 0.3.2	Windows
Vulnerabilities CVE-2016-6298 are fixed in Python-jwcrypto for linux 0.3.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234