CVE-2016-5430 The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain clear...
MediumCVSS 5.3
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jose-php project jose-php | < 2.2.1 | 2.2.1 |
References
- 92741 third-party-advisory vdb-entry
- github.com patch