2739 matches found
CVE-2022-24772
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...
CVE-2022-24772 Improper Verification of Cryptographic Signature in `node-forge`
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...
CVE-2022-24772 Improper Verification of Cryptographic Signature in `node-forge`
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...
CVE-2022-24772
Removed by vendor...
CVE-2022-24773 Improper Verification of Cryptographic Signature in `node-forge`
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that...
CVE-2022-24773
Forge also called "node-forge" is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not properly check "DigestInfo" for a proper ASN.1 structure. This can lead to successful verification with signatures that...
CVE-2022-24773
Removed by vendor...
CVE-2022-24773: Improper Verification of Cryptographic Signature
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that...
Debian DLA-2953-1 : openssl1.0 - LTS security update
The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2953 advisory. Tavis Ormandy discovered that the BNmodsqrt function of OpenSSL could be tricked into an infinite loop. This could result in denial of service via malformed certificates. F...
Debian DLA-2952-1 : openssl - LTS security update
The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2952 advisory. - There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests...
openssl-src's infinite loop in `BN_mod_sqrt()` reachable when parsing certificates
The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a...
FreeBSD : OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates (ea05c456-a4fd-11ec-90de-1c697aa5a594)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ea05c456-a4fd-11ec-90de-1c697aa5a594 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loo...
SUSE SLES12: libopenssl-devel / libopenssl1_0_0 / libopenssl1_0_0-32bit / etc (SUSE-SU-2022:0854-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0854-1 advisory. - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. Tenable has extracted the preceding description...
OpenSSL 3.0.0 < 3.0.2 Vulnerability
The version of OpenSSL installed on the remote host is prior to 3.0.2. It is, therefore, affected by a vulnerability as referenced in the 3.0.2 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internal...
Debian DSA-5103-1 : openssl - security update
The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5103 advisory. Tavis Ormandy discovered that the BNmodsqrt function of OpenSSL could be tricked into an infinite loop. This could result in denial of service via malformed...
OpenSSL: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778) - Linux
OpenSSL is prone to an infinite loop vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Code injection
The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a...
CVE-2022-0778 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a...
CVE-2022-0778 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a...
