CVE-2016-1494: Input Validation
Published Jan 13, 2016
·Updated
The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.
Affected Software
7 affected componentsFixes available
pip/rsa<3.3
3.3
Python Rsa Python<3.3
Fedoraproject Fedora=22
Fedoraproject Fedora=23
openSUSE Leap=42.1
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Remediation
Event History
Jan 13, 2016
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
May 14, 2022
Advisory Published
via GitHub·12:59 AM
Sep 3, 2025
Data Sourced
via Microsoft·10:43 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2016-1494?
CVE-2016-1494 has a moderate severity rating due to its potential to allow spoofing of signatures.
2
How do I fix CVE-2016-1494?
To fix CVE-2016-1494, upgrade the RSA package for Python to version 3.3 or later.
3
Which versions are affected by CVE-2016-1494?
CVE-2016-1494 affects all versions of the RSA package prior to 3.3.
4
What type of attack is associated with CVE-2016-1494?
CVE-2016-1494 is associated with a crafted signature padding attack, known as a BERserk attack.
5
What software packages are vulnerable to CVE-2016-1494?
Software packages vulnerable to CVE-2016-1494 include Python-RSA versions before 3.3, Fedora versions 22 and 23, and openSUSE versions 13.1, 13.2, and 42.1.