CVE-2002-1446: The error checking routine used for the C_Verify call on a symmetric verification key in the nCipher PKCS#1...

Security readout for executives and security teams

This flaw could make software trust a bad message signature as valid when using nCipher's PKCS#11 C_Verify routine with a symmetric verification key. In business terms, systems depending on that check could accept modified or forged messages. The bundle does not provide CVSS, exploitation evidence, or a fixed version. Likely exposure is limited to environments using nCipher PKCS#11 library 1.2.0 or later where applications call C_Verify with symmetric verification keys for security decisions. The source bundle does not identify specific downstream products, platforms, or deployment patterns. Treat as high priority where nCipher PKCS#11 verifies business-critical or security-critical messages. The risk is lower where the library is absent or C_Verify symmetric verification is unused. Remediation should start with exposure confirmation because the affected product data is incomplete. Mitigation focus: Inventory systems using nCipher PKCS#11 library 1.2.0 or later.; Identify applications relying on C_Verify with symmetric verification keys.; Review nCipher advisory or support channels for fixed versions or workarounds..

Prepared

Jun 30, 2026, 03:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.