238 matches found
AZL-34764 CVE-2023-45287 affecting package golang for versions less than 1.20.0-1
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
CVE-2023-45287
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
CVE-2023-45287 Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
CVE-2023-45287
Summary of CVE-2023-45287 (Go): Before Go 1.20, RSA-based TLS key exchanges used math/big (not constant time). RSA blinding was applied but may not fully prevent timing leaks after removal of PKCS#1 padding, potentially enabling recovery of session key bits. Go 1.20+ switched crypto/tls to a full...
GO-2023-2375 Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
CVE-2023-49290 vulnerabilities
Vulnerabilities for packages: falcoctl, vexctl, kubescape, gitsign, cosign-fips, tekton-chains, falcoctl-fips...
PT-2023-29487
Name of the Vulnerable Software and Affected Versions Go versions prior to 1.20 Description The issue concerns the RSA-based TLS key exchanges in Go, which used the math/big library that is not constant time. Although RSA blinding was applied to prevent timing attacks, analysis suggests this may...
CVE-2023-45283 vulnerabilities
Vulnerabilities for packages: go...
Rocky Linux 8 : nginx:1.20 (RLSA-2022:0323)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0323 advisory. - A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory...
RHEL 8 : nginx:1.20 (RHSA-2023:5715)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5715 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...
CVE-2023-45102
Cross-Site Request Forgery CSRF vulnerability in OTWthemes Blog Manager Light plugin = 1.20 versions...
WordPress plugin Blog Manager Light Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
PT-2023-29403 · Otwthemes · Otwthemes Blog Manager Light
Name of the Vulnerable Software and Affected Versions: OTWthemes Blog Manager Light plugin versions = 1.20 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...
CVE-2023-39325 vulnerabilities
Vulnerabilities for packages: falcoctl, wavefront-collector-for-kubernetes, trillian, kubescape, secrets-store-csi-driver-provider-gcp, kubernetes-ingress-defaultbackend, kubernetes-dashboard, kubernetes-csi-livenessprobe-fips, kaf, stakater-reloader, metacontroller, trust-manager,...
CVE-2023-29409 vulnerabilities
Vulnerabilities for packages: kind, go, kubeflow-katib...
CVE-2023-29409 vulnerabilities
Vulnerabilities for packages: kubeflow-katib, go, kind...
SUSE-SU-2023:2869-1 Security update for cni-plugins
This update of cni-plugins fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...
PT-2023-36230 · Cni +1 · Cni +1
Name of the Vulnerable Software and Affected Versions: cni affected versions not specified Description: The issue is related to a security release in the go 1.20 package, which is used to rebuild the cni package. Recommendations: At the moment, there is no information about a newer version that...