5193 matches found
Insecure Verification Of Cryptographic Signature
aws-encryption-sdk suffers from an insecure verification of cryptographic signature. A flawed implementation of message decryption process allows the client code to read ESDK messages from untrusted sources to the end of the stream...
@aws-crypto/example-browser (>=0.1.0-preview.1 <=0.1.0-preview.5), @aws-crypto/integration-browser (>=0.2.0-preview.1 <=0.2.0-preview.5) potentially affected by unknown CVE via @aws-crypto/client-browser (=0.1.0-preview.5)
@aws-crypto/client-browser NPM version =0.1.0-preview.5 is affected by a known vulnerability. The following packages have a transitive dependency on @aws-crypto/client-browser and may be impacted: - @aws-crypto/example-browser =0.1.0-preview.1, =0.2.0-preview.1, =0.2.0-preview.5 Source cves:...
@aws-crypto/example-node (>=0.2.0-preview.1 <=0.2.0-preview.5), @aws-crypto/integration-node (>=0.2.0-preview.1 <=0.2.0-preview.5) potentially affected by unknown CVE via @aws-crypto/client-node (=0.1.0-preview.5)
@aws-crypto/client-node NPM version =0.1.0-preview.5 is affected by a known vulnerability. The following packages have a transitive dependency on @aws-crypto/client-node and may be impacted: - @aws-crypto/example-node =0.2.0-preview.1, =0.2.0-preview.1, =0.2.0-preview.5 Source cves: unknown CVE...
GHSA-H45P-W933-JXH3 Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript
Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...
Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript
Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...
GHSA-89V2-G37M-G3FF Improper Verification of Cryptographic Signature in aws-encryption-sdk-cli
Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...
Improper Verification of Cryptographic Signature in aws-encryption-sdk-cli
Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...
GHSA-X5H4-9GQW-942J Improper Verification of Cryptographic Signature in aws-encryption-sdk
Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...
Improper Verification of Cryptographic Signature in aws-encryption-sdk
Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...
br.com.guiabolso:hyperloop-transport (=3.0.1), com.eoniantech:secrets-locker (>=1.0 <=1.2) +8 more potentially affected by CVE-2024-23680 via com.amazonaws:aws-encryption-sdk-java (>=0.0.1 <=1.7.0)
com.amazonaws:aws-encryption-sdk-java MAVEN version =0.0.1, =1.0, =2.3.2, =0.3.0, =2.8.0, =2.11.1 - org.apache.ignite:ignite-aws-ext =1.0.0 - org.dreamhorizon:vertx-cron =1.0.0 - software.amazon.cloudformation:aws-cloudformation-rpdk-java-plugin =2.0.12 Source cves: CVE-2024-23680 Source advisory...
GHSA-55XH-53M6-936R Improper Verification of Cryptographic Signature in aws-encryption-sdk-java
Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth...
Improper Verification of Cryptographic Signature in aws-encryption-sdk-java
Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth...
Improper Verification of Cryptographic Signature in aws-encryption-sdk-java
This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages...
Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript
This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated...
Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript
This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the...
Bucky - An Automatic S3 Bucket Discovery Tool
Bucky is an automatic tool designed to discover S3 bucket misconfiguration, Bucky consists up of two modules Bucky firefox addon and Bucky backend engine. Bucky addon reads the source code of the webpages and uses Regular ExpressionRegex to match the S3 bucket used as Content Delivery NetworkCDN...
Important Photon OS Security Update - PHSA-2021-4.0-0031
Updates of 'linux-aws', 'zookeeper', 'linux-secure', 'linux-rt', 'linux' packages of Photon OS have been released...
Imperva® Offers Free Serverless Protection for AWS Lambda
Just as other instant computing infrastructures have done in the past, Function-as-a-Service FaaS now enables DevOps teams to deploy applications more efficiently at a fraction of the cost. AWS Lambda, Amazon Web Services’ AWS serverless approach to infrastructure, enables companies to go-to-mark...
Courier: 2 Bypass of #1067533 rate limit via X-Forwarded-For<space>: Source IP on ( www.trycourier.app )
A vulnerability with AWS API Gateway was uncovered that allowed rate limiting to be bypassed when the X-Forwarded-For headed was manipulated a string added to the header key I was able to bypass the rate limit by adding extra space before the colon X-Forwarded-For: 127.0.0.1. The actual bug was i...