CLSA-2026-1791541027
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791541027.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791541027
- Upstream
CVE (2)
- Published
- 2026-10-09T10:17:18Z
- Modified
- 2026-10-26T09:32:02Z
- Summary
- Fix CVE(s): CVE-2018-16869
- Details
-
- SECURITY UPDATE: Bleichenbacher-type side-channel in RSA decryption
- debian/patches/CVE-2018-16869-1.patch: add side-channel silent memeql_sec and cnd_memcpy in memeql-sec.c, cnd-memcpy.c, memops.h, ccm.c, examples/rsa-decrypt.c, Makefile.in, testsuite.
- debian/patches/CVE-2018-16869-2.patch: add side-channel silent RSA root function _rsa_sec_compute_root and mpn_get_base256 in rsa-sec-compute-root.c, rsa-internal.h, gmp-glue.c, gmp-glue.h, Makefile.in.
- debian/patches/CVE-2018-16869-3.patch: add side-channel silent PKCS#1 decoding _pkcs1_sec_decrypt in pkcs1-sec-decrypt.c, rsa-internal.h, Makefile.in, testsuite.
- debian/patches/CVE-2018-16869-4.patch: add rsa_sec_decrypt and use the side-channel silent root in rsa_compute_root_tr and rsa_compute_root, and reject bad private keys early, in rsa-sec-decrypt.c, rsa-sign-tr.c, rsa-sign.c, rsa-sec-compute-root.c, rsa.h, Makefile.in, testsuite.
- debian/patches/CVE-2018-16869-5.patch: require input in range and of fixed size in rsa_sec_decrypt, rsa_decrypt_tr, rsa_decrypt and rsa_sec_compute_root_tr, and check the message length in _pkcs1_sec_decrypt, in pkcs1-sec-decrypt.c, rsa-decrypt-tr.c, rsa-decrypt.c, rsa-sec-decrypt.c, rsa-sign-tr.c, rsa.h, testsuite.
- debian/patches/CVE-2018-16869-6.patch: strip the PKCS#1 padding in rsa_decrypt and rsa_decrypt_tr with the side-channel silent _pkcs1_sec_decrypt_variable, in pkcs1-sec-decrypt.c, pkcs1-decrypt.c, rsa-decrypt-tr.c, rsa-internal.h, testsuite.
- debian/libhogweed4.symbols, debian/libnettle6.symbols: added new symbols.
- CVE-2018-16869
- CVE-2021-3580 (the input range checks in CVE-2018-16869-5.patch)
- SECURITY UPDATE: Bleichenbacher-type side-channel in RSA decryption
- References
Affected packages
TuxCare:Ubuntu:16.04 / libhogweed4
Package
- Name
- libhogweed4
- Purl
- pkg:deb/tuxcare/libhogweed4?distro=ubuntu-16.04
TuxCare:Ubuntu:16.04 / libnettle6
Package
- Name
- libnettle6
- Purl
- pkg:deb/tuxcare/libnettle6?distro=ubuntu-16.04
TuxCare:Ubuntu:16.04 / nettle-bin
Package
- Name
- nettle-bin
- Purl
- pkg:deb/tuxcare/nettle-bin?distro=ubuntu-16.04