p PatchFirst

CVE-2016-6298

CVE-2016-6298

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

CVSS 6.0 · Medium · EPSS 2.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-jwcrypto Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.3.2-1

    Update to 0.3.2-1

  • python-jwcrypto Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.3.2-1

    Update to 0.3.2-1

  • python-jwcrypto Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.3.2-1

    Update to 0.3.2-1

  • jwcrypto PyPI

    Versions
    • 0.2.0
    • 0.2.1
    • 0.3.0
    • 0.3.1
    Affected ranges
    • ECOSYSTEM: < 0.3.2

    Update to 0.3.2

  • jwcrypto PyPI

    Versions
    • 0.2.0
    • 0.2.1
    • 0.3.0
    • 0.3.1
    • v0.3.1
    • v0.3.0
    • v0.2.1
    • v0.2.0
    • v0.1.0
    Affected ranges
    • GIT: < eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba
    • ECOSYSTEM: < 0.4.0

    Update to 0.4.0

  • python-jwcrypto Ubuntu:16.04:LTS

    Versions
    • 0.2.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →