{"id":"CVE-2016-1494","aliases":["DEBIAN-CVE-2016-1494","EUVD-2016-0032","GHSA-8rjr-6qq5-pj9p","MGASA-2016-0011","PYSEC-2016-10","SUSE-SU-2016:0107-1","UBUNTU-CVE-2016-1494"],"status":"published","title":"Python RSA allows attackers to spoof signatures","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06996,"percentile":0.94203,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-347"],"published":"2016-01-12T09:13:53Z","modified":"2026-09-22T07:01:15Z","exploits":[{"source":"pocgithub","id":"matthiasbe/secuimag3a","title":"matthiasbe/secuimag3a","date":"2016-12-02","url":"https://github.com/matthiasbe/secuimag3a"}],"fixes":[{"ecosystem":"PyPI","package":"rsa","fixed_in":["3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-rsa","fixed_in":["3.2.3-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-rsa","fixed_in":["3.2.3-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-rsa","fixed_in":["3.2.3-1.1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"python-rsa","fixed_in":["3.1.4-6.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-rsa","fixed_in":["3.1.4-11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-rsa","fixed_in":["3.1.2-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3"}]}],"versions":["1.1","1.2","1.3","1.3.1","1.3.2","1.3.3","2.0","3.0","3.0.1","3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.2","3.2.1","3.2.2","3.2.3"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-6.1.mga5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3"}]}],"versions":["1.1","1.2","1.3","1.3.1","1.3.2","1.3.3","2.0","3.0","3.0.1","3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.2","3.2.1","3.2.2","3.2.3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-1ubuntu0.1"}]}],"versions":["3.1.2-1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"python","product":"rsa"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/01/05/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/79829","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/01/05/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175897.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-01/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by/diff","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175942.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1494","tags":["advisory"]},{"url":"https://github.com/sybrenstuvel/python-rsa/commit/ab5d21c3b554f926d51ff3ad9c794bcf32e95b3c","tags":["web"]},{"url":"https://web.archive.org/web/20210123020914/http://www.securityfocus.com/bid/79829","tags":["web"]},{"url":"https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/rsa/PYSEC-2016-10.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8rjr-6qq5-pj9p","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1494","tags":["advisory"]},{"url":"https://github.com/sybrenstuvel/python-rsa","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0011.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17451","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/01/05/3","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160107-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/960680","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1494","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-1494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1494","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1494","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","status":"published","published":"2016-01-13T15:00:00Z","modified":"2024-08-05T22:55:14.815Z","updated_at":"2026-11-02T14:33:35.841056Z"}],"euvd":[{"id":"EUVD-2016-0032","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","status":"published","published":"2016-01-13T15:00:00Z","modified":"2024-08-05T22:55:14Z","updated_at":"2026-11-03T02:22:57.974183Z"}],"ghsa":[{"id":"GHSA-8rjr-6qq5-pj9p","title":"Python RSA allows attackers to spoof signatures","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","status":"published","published":"2022-05-14T00:59:49Z","modified":"2024-10-21T21:53:43Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-347"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2016-1494","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","status":"published","published":"2016-01-13T15:59:02.787Z","modified":"2026-06-17T00:42:04.573Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:21.143462Z"}],"osv":[{"id":"CVE-2016-1494","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","status":"published","published":"2016-01-13T15:59:02.787Z","modified":"2026-04-16T06:20:12.793908791Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1494","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","status":"published","published":"2016-01-13T15:59:02.787Z","modified":"2026-09-22T07:01:15.256195329Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-8rjr-6qq5-pj9p","title":"Python RSA allows attackers to spoof signatures","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","status":"published","published":"2022-05-14T00:59:49Z","modified":"2024-10-21T22:10:52.441583Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-347"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"UBUNTU-CVE-2016-1494","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","status":"published","published":"2016-01-13T15:59:00Z","modified":"2025-07-18T16:43:23Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"MGASA-2016-0011","title":"Updated python-rsa packages fix security vulnerability","description":"A signature forgery vulnerability in python-rsa allows an attacker to fake\nsignatures for arbitrary messages for any key with a low exponent \"e\",\nsuch as the common value of 3 (CVE-2016-1494).\n","status":"published","published":"2016-01-12T09:13:53Z","modified":"2026-04-16T06:26:15.705336069Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"PYSEC-2016-10","description":"The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.","status":"published","published":"2016-01-13T15:59:00Z","modified":"2026-06-10T17:02:37.320428281Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2016:0107-1","title":"Security update for python-rsa","description":"\nThis update for python-rsa fixes the following security issue:\n\n* CVE-2016-1494: Possible signature forgery via Bleichenbacher attack (bsc#960680)\n","status":"published","published":"2016-01-13T14:12:36Z","modified":"2026-02-04T04:28:33.336012Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}