{"id":"CVE-2016-6129","aliases":["DEBIAN-CVE-2016-6129","DLA-612-1","EUVD-2016-7063","MGASA-2016-0369","UBUNTU-CVE-2016-6129"],"status":"published","title":"libtomcrypt - security update","description":"The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00768,"percentile":0.55815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-09-06T00:00:00Z","modified":"2026-10-27T04:15:26Z","fixes":[{"ecosystem":"Debian:12","package":"libtomcrypt","fixed_in":["1.17-8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libtomcrypt","fixed_in":["1.17-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libtomcrypt","fixed_in":["1.17-8"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libtomcrypt","fixed_in":["1.17-3.2+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libtomcrypt","fixed_in":["1.17-7.1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libtomcrypt","fixed_in":["1.17-5ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libtomcrypt","fixed_in":["1.17-7ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libtomcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-8"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libtomcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libtomcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-8"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libtomcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-3.2+deb7u1"}]}],"versions":["1.17-3.2"]},{"source":"osv","ecosystem":"Mageia:5","package":"libtomcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-7.1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libtomcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-5ubuntu0.1"}]}],"versions":["1.17-3.2ubuntu1","1.17-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libtomcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-7ubuntu0.1"}]}],"versions":["1.17-7"]}],"products":[{"vendor":"libtom","product":"libtomcrypt"},{"vendor":"trustedfirmware","product":"op-tee"}],"references":[{"url":"https://github.com/libtom/libtomcrypt/commit/5eb9743410ce4657e9d54fef26a2ee31a1b5dd0","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1370955","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://www.op-tee.org/advisories/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6129","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0369.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19305","tags":["report"]},{"url":"http://lwn.net/Alerts/699791/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-6129","tags":["report"]},{"url":"https://github.com/OP-TEE/optee_os/commit/30d13250c390c4f56adefdcd3b64b7cc672f9fe2","tags":["report"]},{"url":"https://github.com/libtom/libtomcrypt/commit/5eb9743410ce4657e9d54fef26a2ee31a1b5dd09","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6129","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-6129","description":"The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.","status":"published","published":"2017-02-13T18:00:00Z","modified":"2024-08-06T01:22:20.23Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2016-7063","description":"The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.","status":"published","published":"2017-02-13T18:00:00Z","modified":"2024-08-06T01:22:20Z","updated_at":"2026-11-03T02:22:40.469928Z"}],"nvd":[{"id":"CVE-2016-6129","description":"The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.","status":"published","published":"2017-02-13T18:59:00.66Z","modified":"2026-06-17T00:50:30.373Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-6129","description":"The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.","status":"published","published":"2017-02-13T18:59:00.66Z","modified":"2026-10-20T10:47:31.434139042Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6129","description":"The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.","status":"published","published":"2017-02-13T18:59:00.66Z","modified":"2026-09-22T07:01:39.345772839Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-6129","description":"The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.","status":"published","published":"2017-02-13T18:59:00Z","modified":"2026-10-27T04:15:26.043145275Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"DLA-612-1","title":"libtomcrypt - security update","status":"published","published":"2016-09-06T00:00:00Z","modified":"2026-03-09T02:09:08.236474Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0369","title":"Updated libtomcrypt packages fix security vulnerability","description":"It was discovered that the implementation of RSA signature verification\nin libtomcrypt is vulnerable to the Bleichenbacher signature attack. If\nan RSA key with exponent 3 is used it may be possible to forge a PKCS#1\nv1.5 signature signed by that key (CVE-2016-6129).\n","status":"published","published":"2016-11-06T13:37:17Z","modified":"2026-04-16T06:22:44.845507455Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}