41732 matches found
Ubuntu: Security Advisory (USN-6531-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-6533-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : PostgreSQL vulnerabilities (USN-6538-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6538-1 advisory. Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown arguments in aggregate function calls. A remote...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : curl vulnerabilities (USN-6535-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6535-1 advisory. Harry Sintonen discovered that curl incorrectly handled mixed case cookie domains. A remote attacker could possibly use this...
Ubuntu 23.10 : Linux kernel (GCP) vulnerabilities (USN-6537-1)
The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6537-1 advisory. Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local privileged...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : python-cryptography vulnerabilities (USN-6539-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6539-1 advisory. It was discovered that the python-cryptography Cipher.updateinto function would incorrectly accept objects with immutable...
CVE-2023-45287
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
Design/Logic Flaw
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
CVE-2023-45287
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
CVE-2023-45287
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
CVE-2023-45287
Summary of CVE-2023-45287 (Go): Before Go 1.20, RSA-based TLS key exchanges used math/big (not constant time). RSA blinding was applied but may not fully prevent timing leaks after removal of PKCS#1 padding, potentially enabling recovery of session key bits. Go 1.20+ switched crypto/tls to a full...
GO-2023-2375 Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
CVE-2023-48236 affecting package vim for versions less than 9.0.2112-1
CVE-2023-48236 affecting package vim for versions less than 9.0.2112-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-29409 affecting package msft-golang for versions less than 1.20.7-1
CVE-2023-29409 affecting package msft-golang for versions less than 1.20.7-1. A patched version of the package is available...
CVE-2023-48237 affecting package vim for versions less than 9.0.2112-1
CVE-2023-48237 affecting package vim for versions less than 9.0.2112-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-48231 affecting package vim for versions less than 9.0.2112-1
CVE-2023-48231 affecting package vim for versions less than 9.0.2112-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-39198 affecting package kernel for versions less than 5.15.138.1-4
CVE-2023-39198 affecting package kernel for versions less than 5.15.138.1-4. A patched version of the package is available...
CVE-2023-48234 affecting package vim for versions less than 9.0.2112-1
CVE-2023-48234 affecting package vim for versions less than 9.0.2112-1. An upgraded version of the package is available that resolves this issue...