CVE-2020-36315: 
NixOS vulnerability analysis and mitigation

In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery can occur because certain checks of the padding (and of the first two bytes) are inadequate. This vulnerability requires that a low public exponent (such as 3) is being used, though the product by default does not generate RSA keys with such a low number (NVD).

The vulnerability stems from two main issues in the PKCS1v1.5 implementation: 1) The checks on the first two bytes (0x00 | 0x01) don't properly reject malformed inputs due to result variable handling, and 2) The padding verification loop only checks for non-zero values instead of requiring 0xFF, allowing arbitrary non-zero padding values. These implementation flaws enable Bleichenbacher-style signature forgery attacks when using small public exponents like e=3 (GitHub Issue).

An attacker could potentially forge RSA PKCS#1 v1.5 signatures when the public exponent is small (e.g., e=3). This allows signature forgery without having access to the private key, compromising the authentication and integrity guarantees provided by the signature scheme (NVD).

The vulnerability has been demonstrated with a proof-of-concept exploit against a 2496-bit RSA modulus using public exponent e=3. While RELIC doesn't generate such keys by default, the API doesn't prevent their use. The attack is feasible when applications use RSA with small public exponents for specific compatibility needs (GitHub Issue).

The issue was fixed in RELIC version 2020-08-01 by inverting the padding check logic and implementing more rigorous verification. The patch improves the signature verification to be more robust against forgery attempts (GitHub Commit).