{"id":"CVE-2018-16253","published":"2018-11-07T20:00:00Z","modified":"2024-08-05T10:17:38Z","title":"In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly…","vendor":null,"product":null,"tier":"tail","description":{"text":"In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509 certificates. This is an even more permissive variant of CVE-2006-4790 and CVE-2014-1568.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00618,"percentile":0.49584,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/igrr/axtls-8266/commit/5efe2947ab45e81d84b5f707c51d1c64be52f36c","tags":["x_refsource_CONFIRM"]},{"url":"https://sourceforge.net/p/axtls/mailman/message/36459928/","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":9.9,"factors":[{"name":"EPSS percentile","points":9.92}]},"euvd":{"id":"EUVD-2018-8105","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-enterprise-linux-3-cve-2006-4339","parents":[{"from":"CVE-2006-4790","to":"CVE-2018-16253","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"This is an even more permissive variant of CVE-2006-4790 and CVE-2014-1568.","from":"CVE.org","in":"CVE-2018-16253"}]},{"from":"CVE-2014-1568","to":"CVE-2018-16253","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"This is an even more permissive variant of CVE-2006-4790 and CVE-2014-1568.","from":"CVE.org","in":"CVE-2018-16253"}]}]}}