CVE-2018-16149 - CVE House
Back to Database
Status published Medium CVE-2018-16149

In sig_verify() in x509.c in axTLS version 2.1.3 and before,...

Vulnerability Description

In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponents are being used, a remote attacker can generate purposefully crafted signatures (and put them on X.509 certificates) to induce illegal memory access and crash the verifier.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-16149

Credits & Attribution

No credits recorded in the NVD database.

References

More from axtls project

View All →
CVE-2019-9689
process_certificate in tls1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has...
High 7.5
CVE-2019-8981
tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer...
Critical 9.8
CVE-2019-10013
The asn1_signature function in asn1.c in Cameron Hamilton-Rich axTLS through...
High 7.5
CVE-2018-16253
In sig_verify() in x509.c in axTLS version 2.1.3 and before,...
Medium 5.9
CVE-2018-16150
In sig_verify() in x509.c in axTLS version 2.1.3 and before,...
Medium 5.9

Affected Vendor

axtls project

View all reports →

Affected Software

axtls
Vulnerable Versions:
0

Timeline

Official Publish: November 7th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.