PT-2021-30031

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.209 Description The issue concerns a resource leak in the ccp run aes gcm cmd function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-26208

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.14.10 Description: The issue concerns resource leaks in the ccp run aes gcm cmd function. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.12 and fixed in...

PT-2021-26008

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.249 Description The issue is related to resource leaks in the ccp run aes gcm cmd function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prio...

PT-2021-26036

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.209 Description The issue is related to resource leaks in the ccp run aes gcm cmd function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prio...

PT-2021-26129

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.71 Description The issue concerns a resource leak in the ccp run aes gcm cmd function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-30124

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.71 Description The issue concerns a resource leak in the ccp run aes gcm cmd function. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.12 and fixed in Lin...

PT-2021-26073

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.151 Description The issue is related to resource leaks in the ccp run aes gcm cmd function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior...

Security issues in AWS KMS and AWS Encryption SDKs: in-band protocol negotiation and robustness

Authors: Thai "thaidn" Duong Summary The following security vulnerabilities was discovered and reported to Amazon, affecting AWS KMS and all versions of AWS Encryption SDKs prior to version 2.0.0: Information leakage: an attacker can create ciphertexts that would leak the user’s AWS account ID,...

GHSA-WQGP-VPHW-HPHF Security issues in AWS KMS and AWS Encryption SDKs: in-band protocol negotiation and robustness

Authors: Thai "thaidn" Duong Summary The following security vulnerabilities was discovered and reported to Amazon, affecting AWS KMS and all versions of AWS Encryption SDKs prior to version 2.0.0: Information leakage: an attacker can create ciphertexts that would leak the user’s AWS account ID,...

Use of a Broken or Risky Cryptographic Algorithm

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM and other AEAD ciphers such as AES-GCM-SIV or XChaCha20Poly1305 used by the SDKs to encrypt messages, an attacker can craft a...

Updated apache-mod_auth_openidc packages fix security vulnerability

In versions prior to 2.4.9, oidcvalidateredirecturl does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. CVE-2021-32786 In modauthopenidc before version 2.4.9, the AES GCM encrypti...

MGASA-2021-0452 Updated apache-mod_auth_openidc packages fix security vulnerability

In versions prior to 2.4.9, oidcvalidateredirecturl does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. CVE-2021-32786 In modauthopenidc before version 2.4.9, the AES GCM encrypti...

CVE-2021-36218

An issue was discovered in SKALE sgxwallet 1.58.3. sgxdispippsAESGCMEncrypt allows an out-of-bounds write, resulting in a segfault and compromised enclave. This issue describes a buffer overflow, which was resolved prior to v1.77.0 and not reproducible in latest sgxwallet v1.77.0...

UBUNTU-CVE-2021-3764

A memory leak flaw was found in the Linux kernel's ccprunaesgcmcmd function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability...

openSUSE: Security Advisory for apache2-mod_auth_openidc (openSUSE-SU-2021:3020-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for apache2-mod_auth_openidc (moderate)

openSUSE Security Update: Security update for apache2-modauthopenidc Announcement ID: openSUSE-SU-2021:3020-1 Rating: moderate References: 1188638 1188639 1188848 1188849 Cross-References: CVE-2021-32785 CVE-2021-32786 CVE-2021-32791 CVE-2021-32792 CVSS scores: CVE-2021-32785 SUSE: 5.3...

PT-2021-4203

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an uncontrolled resource consumption in the Linux kernel's ccp-ops cryptodriver. It is caused by a memory leak flaw in the ccp run aes gcm cmd function in...

CVE-2021-32791

A flaw was found in modauthopenidc. The AES GCM encryption uses a static IV and AAD which could lead to other cryptographic attacks. The highest threat from this liability is to data confidentiality...

CVE-2021-32791

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In modauthopenidc before version 2.4.9, the AES GCM encryption in modauthopenidc uses a static IV and...

DEBIAN-CVE-2021-32791

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In modauthopenidc before version 2.4.9, the AES GCM encryption in modauthopenidc uses a static IV and...