CVE-2016-1494 describes a signature forgery vulnerability in the Python-RSA library (versions prior to 3.3), affecting products like fedoraproject and opensuse. This medium-severity flaw (CVSS 5.3) allows attackers to spoof RSA signatures using a small public exponent and crafted padding, known as a BERserk attack, leading to a potential loss of integrity. While no active exploitation, Metasploit, or ExploitDB modules exist, the vulnerability has seen minimal community discussion with one Reddit mention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.3CPE matchmatch criteria | cpe:2.3:a:python:rsa:*:*:*:*:*:python:*:* | ||
22CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* | ||
23CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* | ||
42.1CPE matchmatch criteria | cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* | ||
13.1CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Python RSA allows attackers to spoof signatures
May 14, 2022The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.
Jan 12, 2016