Severity by source
Network vector for TLS; AC:H because mTLS configuration and RSA-PSS negotiation are non-default; PR:N as attacker needs no pre-existing credentials; no availability impact.
Lifecycle Timeline
1DescriptionCVE.org
[RSA-PSS CertificateVerify checks only 0xbc trailer]
AnalysisAI
RSA-PSS signature verification in a TLS library's CertificateVerify processing validates only the mandatory 0xbc trailer byte rather than performing complete cryptographic verification of the PSS-encoded signature structure. This flaw, reported by Ubuntu, could allow a remote attacker to forge RSA-PSS CertificateVerify messages during a TLS handshake, potentially enabling authentication bypass without possession of a valid private key. No public exploit or CISA KEV entry is associated with this CVE at time of analysis.
Technical ContextAI
RSA-PSS (Probabilistic Signature Scheme) is the recommended RSA signature mode in TLS 1.3's CertificateVerify message, governed by RFC 8446 Section 4.4.3. In the EMSA-PSS encoding defined in PKCS#1 v2.2, the encoded message must terminate with a 0xbc trailer byte identifying the hash function. A correct verification routine must validate the full masking, salt, and hash components - not merely the presence of the trailing 0xbc octet. If an implementation shortcuts to only checking this trailer, an adversary can construct a syntactically minimal but cryptographically invalid signature that passes the check. The specific affected library or package is not confirmed by CPE or vendor advisory data; the vulnerability was reported through Ubuntu's security channels. No CWE classification was provided, but the root cause class is most analogous to CWE-347 (Improper Verification of Cryptographic Signature).
Affected ProductsAI
The specific affected product, version range, and CPE are not identified in the available intelligence data. The vulnerability was reported via Ubuntu, suggesting the affected component is a library packaged by Ubuntu (candidates include OpenSSL, GnuTLS, NSS, or wolfSSL, all of which Ubuntu distributes and which implement RSA-PSS CertificateVerify). No vendor advisory URL, CPE string, or fix version was provided. Defenders should monitor Ubuntu Security Notices (USN) and the relevant upstream library advisory channels for authoritative affected-version ranges.
RemediationAI
No patch version or vendor advisory URL was provided in the available intelligence data. Defenders should monitor Ubuntu Security Notices at ubuntu.com/security/notices for the corresponding USN advisory, which will identify the affected package and fixed version. As an immediate compensating control, consider disabling RSA-PSS-based client certificate authentication (mutual TLS) on any TLS endpoint using the potentially affected library, switching to ECDSA or RSA-PKCS1v1.5 CertificateVerify schemes where operationally acceptable - note this changes your cipher suite and may affect compatibility with some clients. Restricting TLS endpoints to only trusted, internal network segments reduces the risk of unauthenticated external exploitation. Do not apply workarounds that bypass certificate verification entirely, as that substitutes a worse risk for the current one.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today