The error checking routine used for the C_Verify call on a symmetric verification key in the nCipher PKCS#11 library 1.2.0 and later returns the CKR_OK status even when it detects an invalid signature, which could allow remote attackers to modify or forge messages.
Get an AI-powered plain-language explanation of this vulnerability and remediation steps.
Login to generate AI explanation8 reference(s) from NVD