CVE-2016-1494: Input Validation
The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/rsato a version that resolves this vulnerability.Fixed in 3.3
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1494?
CVE-2016-1494 has a moderate severity rating due to its potential to allow spoofing of signatures.
How do I fix CVE-2016-1494?
To fix CVE-2016-1494, upgrade the RSA package for Python to version 3.3 or later.
Which versions are affected by CVE-2016-1494?
CVE-2016-1494 affects all versions of the RSA package prior to 3.3.
What type of attack is associated with CVE-2016-1494?
CVE-2016-1494 is associated with a crafted signature padding attack, known as a BERserk attack.
What software packages are vulnerable to CVE-2016-1494?
Software packages vulnerable to CVE-2016-1494 include Python-RSA versions before 3.3, Fedora versions 22 and 23, and openSUSE versions 13.1, 13.2, and 42.1.