Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The error checking routine used for the C_Verify call on a symmetric verification key in the nCipher PKCS#11 library 1.2.0 and later returns the CKR_OK status even when it detects an invalid signature, which could allow remote attackers to modify or forge messages.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
nCipher PKCS#11对称消息签名验证漏洞
Vulnerability Description
nCipher PKCS#11 库1.2.0之后版本的对称密钥验证中用于C_Verify调用的错误检查惯例在即使删除有效签名时仍返回CKR_OK状态。远程攻击者可以利用该漏洞修改或伪造消息。
CVSS Information
N/A
Vulnerability Type
N/A