Python RSA allows attackers to spoof signatures

published 2016-01-13 10 y ago modified 2026-06-17 4 mo ago also GHSA-8rjr-6qq5-pj9p , PYSEC-2016-10 , EUVD-2016-0032

cvss: 5.3; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.0%; EPSS 7.0% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

Patch / fix

fixed in 2 distros 3 links 2

pypi rsa 3.3
python rsa 3.3

debian ubuntu suse

python-rsa Debian 14, Debian 13, Debian 12 3.2.3-1.1

debian advisories DEBIAN-CVE-2016-1494

python-rsa Ubuntu 14.04 LTS 3.1.2-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2016-1494

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-rsa SLE Module for Public Cloud 12 3.1.4-11.1

suse advisories SUSE-SU-2016:0107-1

github.com/sybrenstuvel/python-rsa@ab5d21c commit
bitbucket.org/sybren/python-rsa#14 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-1494 updated 2025-11-21 cvss 4.3

python-rsa: Signature forgery using Bleichenbacher'06 attack

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.00% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

blog.filippo.io https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub	3.0	5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	rsa	<3.3	3.3

Classification

Weakness

CWE-20 Improper Input Validation
CWE-347 Improper Verification of Cryptographic Signature

References

bitbucket.org /sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by/diff
web, patch, third-party-advisory
github.com /sybrenstuvel/python-rsa/commit/ab5d21c3b554f926d51ff3ad9c794bcf32e95b3c
web
blog.filippo.io /bleichenbacher-06-signature-forgery-in-python-rsa/
exploit, third-party-advisory, article
lists.fedoraproject.org /pipermail/package-announce/2016-January/175897.html
vendor-advisory, web, third-party-advisory
lists.opensuse.org /opensuse-updates/2016-01/msg00032.html
vendor-advisory, web, mailing-list, third-party-advisory
lists.fedoraproject.org /pipermail/package-announce/2016-January/175942.html
vendor-advisory, web, third-party-advisory
openwall.com /lists/oss-security/2016/01/05/3
mailing-list, web, third-party-advisory
securityfocus.com /bid/79829
vdb-entry, third-party-advisory, web
openwall.com /lists/oss-security/2016/01/05/1
mailing-list, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2016-1494
advisory
blog.filippo.io /bleichenbacher-06-signature-forgery-in-python-rsa
web
github.com /pypa/advisory-database/tree/main/vulns/rsa/PYSEC-2016-10.yaml
web
github.com /sybrenstuvel/python-rsa
package
web.archive.org /web/20210123020914/http://www.securityfocus.com/bid/79829
web
github.com /advisories/GHSA-8rjr-6qq5-pj9p
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary