CVE-2018-15836
High
Description
In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.
SeverityHigh
CVSS7.5
Exploit probability—
ProductXelerance Openswan
PublishedSep 26, 2018
First seenSep 26, 2018
How to fix
Update
- xelerance openswan2.6.50.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xelerance openswan | v < 2.6.50.1 | 2.6.50.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.