cve.bz

CWE-347: Improper Verification of Cryptographic Signature, page 18

Filter

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

What the weakness is: CWE-347 at MITRE

Ask an AI about CWE-347

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-347: Improper Verification of Cryptographic Signature and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/347.html and https://cve.bz/cve/cwe/347?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.7CVE-2020-3138EPSS 0.2%

    A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a malicious file when upgrading. The vulnerability is due to insufficient signature va…

  2. 9.8CVE-2020-6174EPSS 1.0%

    TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.

  3. 7.5CVE-2020-7906EPSS 0.7%

    In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019.3.

  4. 7.5CVE-2020-5390EPSS 1.2%

    PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is si…

  5. 9.1CVE-2019-14859EPSS 1.5%

    A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Withou…

  6. 7.5CVE-2019-19962EPSS 0.9%

    wolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in RSA cryptography.

  7. 8.1CVE-2019-16732EPSS 0.9%

    Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user.

  8. 5.9CVE-2012-2092EPSS 3.7%

    A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature.

  9. 7.5CVE-2019-16753EPSS 0.7%

    An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed is composed of a representation of strings, rather than being composed of their binary representations. This is a weak si…

  10. 3.7CVE-2011-3374EPSS 1.2%

    It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

  11. 9.8CVE-2014-3585EPSS 1.1%

    redhat-upgrade-tool: Does not check GPG signatures when upgrading versions

  12. 8.8CVE-2019-3465EPSS 3.0%

    Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate pr…

  13. 7.8CVE-2019-0071EPSS 0.2%

    Veriexec is a kernel-based file integrity subsystem in Junos OS that ensures only authorized binaries are able to be executed. Due to a flaw in specific versions of Junos OS, affecting specific EX Series platforms, the Veriexec subsystem w…

  14. 7.5CVE-2019-16992EPSS 0.9%

    The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation (that an address at keybase.io can be used for Stellar payments to the user), wh…

  15. 7.5CVE-2019-11755EPSS 1.3%

    A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might …

  16. 6.7CVE-2019-12662EPSS 0.3%

    A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on …

  17. 6.7CVE-2019-12649EPSS 0.2%

    A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability ex…

  18. 6.5CVE-2019-3738EPSS 1.7%

    RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predic…

  19. 7.5CVE-2019-15545EPSS 0.8%

    An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.

  20. 5.9CVE-2019-5592EPSS 0.7%

    Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with S…

  21. 7.5CVE-2019-9154EPSS 1.6%

    Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.

  22. 7.5CVE-2019-9153EPSS 2.0%

    Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.

  23. 8.1CVE-2019-10201EPSS 0.7%

    It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can b…

  24. 7.8CVE-2019-5299EPSS 0.7%

    Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vulnerability. Attackers can induce users to install malicious applications. Due to a defect in the signature verification …

  25. 4.8CVE-2017-18407EPSS 0.4%

    cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).

  26. 7.8CVE-2019-2278EPSS 0.2%

    User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636,…

  27. 9.8CVE-2019-1010161EPSS 1.1%

    perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in _decode_jws(). The attack vector is: network connectivity(craftin…

  28. 7.5CVE-2019-1010279EPSS 1.5%

    Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packe…

  29. 9.8CVE-2019-1010263EPSS 1.3%

    Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: networ…

  30. 6.5CVE-2019-9149EPSS 0.9%

    Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign (and encrypt) arbitrary messages with Mailvelope, assuming the pr…

  31. 9.8CVE-2019-13177EPSS 1.6%

    verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification pro…

  32. 4.3CVE-2019-10136EPSS 0.6%

    It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session val…

  33. 6.7CVE-2019-5300EPSS 0.2%

    There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly ve…

  34. 5.9CVE-2019-11841EPSS 2.0%

    A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message …

  35. 7.5CVE-2019-12269EPSS 1.2%

    Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.

  36. 5.9CVE-2019-8338EPSS 1.7%

    The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed emai…

  37. 5.9CVE-2018-12556EPSS 1.8%

    The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn releas…

  38. 6.7CVE-2019-1813EPSS 0.3%

    A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerab…

  39. 6.7CVE-2019-1812EPSS 0.3%

    A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerab…

  40. 6.7CVE-2019-1811EPSS 0.3%

    A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerab…

  41. 6.7CVE-2019-1810EPSS 0.3%

    A vulnerability in the Image Signature Verification feature used in an NX-OS CLI command in Cisco Nexus 3000 Series and 9000 Series Switches could allow an authenticated, local attacker with administrator-level credentials to install a mal…

  42. 6.7CVE-2019-1809EPSS 0.2%

    A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerab…

  43. 4.4CVE-2019-1808EPSS 0.2%

    A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerab…

  44. 6.0CVE-2019-1729EPSS 0.2%

    A vulnerability in the CLI implementation of a specific command used for image maintenance for Cisco NX-OS Software could allow an authenticated, local attacker to overwrite any file on the file system including system files. These file ov…

  45. 6.7CVE-2019-1728EPSS 0.2%

    A vulnerability in the Secure Configuration Validation functionality of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to run arbitrary commands at system boot time with the privileges of root. Th…

  46. 5.3CVE-2018-18509EPSS 1.7%

    A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse …

  47. 7.5CVE-2018-7340EPSS 0.9%

    Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signatur…

  48. 9.8CVE-2019-6318EPSS 2.6%

    HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an insufficient solution bundle signature validation that potentially allows execution of arbitrary code.

  49. 9.8CVE-2018-5923EPSS 2.6%

    In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature checking may allow potential execution of arbitrary code.

  50. 7.0CVE-2018-3968EPSS 0.3%

    An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verifie…