CVE-2020-36315 Weak cryptography in n/a
Attackers can forge RSA signatures if a low public exponent is used, bypassing authentication checks in the RELIC library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36315?
CVE-2020-36315 is a medium-severity vulnerability in n/a, published on 7 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery can occur because certain checks of the padding (and of the first two bytes) are inadequate. NOTE: this requires that a low public exponent (such as 3) is being used. The product, by default, does not generate RSA keys with such a low number.
Weakness: CWE-327
Which versions are affected by CVE-2020-36315?
It affects 1 product.
Products include Relic Project Relic.
How do I fix CVE-2020-36315?
No fix has been published for CVE-2020-36315 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36315 being exploited?
There is no known exploitation of CVE-2020-36315 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cc5x-p8hp-xch9.