CVE-2016-6298

The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

• CWE-200

• http://www.securityfocus.com/bid/92729Broken Link, Third Party Advisory, VDB Entry
• https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7baIssue Tracking, Patch, Vendor Advisory
• https://github.com/latchset/jwcrypto/issues/65Issue Tracking, Vendor Advisory
• https://github.com/latchset/jwcrypto/pull/66Issue Tracking, Patch
• https://github.com/latchset/jwcrypto/releases/tag/v0.3.2Patch, Vendor Advisory
• http://www.securityfocus.com/bid/92729Broken Link, Third Party Advisory, VDB Entry
• https://github.com/latchset/jwcrypto/commit/eb5be5bd94c8cae1d7f3ba9801377084d8e5a7baIssue Tracking, Patch, Vendor Advisory
• https://github.com/latchset/jwcrypto/issues/65Issue Tracking, Vendor Advisory
• https://github.com/latchset/jwcrypto/pull/66Issue Tracking, Patch
• https://github.com/latchset/jwcrypto/releases/tag/v0.3.2Patch, Vendor Advisory

Published

Sep 1, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6292The exif_process_user_comment function in ext/exif/exif.c in…
• CVE-2016-6293The uloc_acceptLanguageFromHTTP function in common/uloc.cpp …
• CVE-2016-6294The locale_accept_from_http function in ext/intl/locale/loca…
• CVE-2016-6295ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, a…
• CVE-2016-6296Integer signedness error in the simplestring_addn function i…
• CVE-2016-6297Integer overflow in the php_stream_zip_opener function in ex…
• CVE-2016-6299The scm plug-in in mock might allow attackers to bypass the …
• CVE-2016-6300Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-6301The recv_and_process_client_pkt function in networking/ntpd.…7.5
• CVE-2016-6302The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL b…
• CVE-2016-6303Integer overflow in the MDC2_Update function in crypto/mdc2/…9.8
• CVE-2016-6304Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, …7.5