CVE-2016-6129 - CVE House
Back to Database
Status published High CVE-2016-6129

The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in...

Vulnerability Description

The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-6129

Credits & Attribution

No credits recorded in the NVD database.

References

More from trustedfirmware

View All →
CVE-2022-47630
Trusted Firmware-A through 2.8 has an out-of-bounds read in the...
Unknown 0
CVE-2022-47549
An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable...
Unknown 0
CVE-2021-45450
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv...
High 7.5
CVE-2021-44149
An issue was discovered in Trusted Firmware OP-TEE Trusted OS...
High 7.8
CVE-2021-43619
Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow...
High 7.8

Affected Vendor

trustedfirmware

View all reports →

Affected Software

op-tee, libtomcrypt
Vulnerable Versions:
0

Timeline

Official Publish: February 13th, 2017
Last Modified: August 6th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.