CVE-2016-6298

Published: Sep 1, 2016Modified: May 6, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.6 / Impact: 3.6

Source: NVD

Description

The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

Affected (1)

Products: Latchset: Jwcrypto

Latchset

1 product

Jwcrypto

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Latchset Jwcrypto	Before 0.3.2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

http://www.securityfocus.com/bid/92729

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba

Source: secalert@redhat.com

Issue TrackingPatchVendor Advisory

https://github.com/latchset/jwcrypto/issues/65

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://github.com/latchset/jwcrypto/pull/66

Source: secalert@redhat.com

Issue TrackingPatch

https://github.com/latchset/jwcrypto/releases/tag/v0.3.2

Source: secalert@redhat.com

PatchVendor Advisory

http://www.securityfocus.com/bid/92729