ALPINE-CVE-2018-16152

See a problem?
Please try reporting it to the source first.
Source
https://security.alpinelinux.org/vuln/CVE-2018-16152
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2018-16152
Upstream
Published
2018-09-26T21:29:01Z
Modified
2026-07-08T04:30:33Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.

References

Affected packages

Alpine:v3.10
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.11
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.12
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.13
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.14
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.15
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.16
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.17
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.18
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.19
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.20
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.21
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.22
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.23
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.24
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.5
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.5.3-r2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.6
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.5.3-r2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.7
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.6.3-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.8
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.6.3-r2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"
Alpine:v3.9
strongswan

Package

Name
strongswan
Purl
pkg:apk/alpine/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.7.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2018-16152.json"