100 matches found
boringssl
BoringSSL BoringSSL is a fork of OpenSSL that is designed to meet Google's needs. Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no...
boringssl
BoringSSL BoringSSL은 Google의 요구를 충족하도록 설계된 OpenSSL의 포크입니다. BoringSSL은 오픈 소스 프로젝트이지만 OpenSSL처럼 일반적인 사용을 위한 것은 아닙니다. 제3자가 이에 의존하는 것은 권장하지 않습니다. API나 ABI 안정성에 대한 보장이 없기 때문에 그렇게 하는 것은 실망스러울 가능성이 높습니다. 프로그램은 BoringSSL을 사용할 때 자체 사본을 제공하며, API 변경을 결정할 때 필요에 따라 모든 것을 업데이트합니다. 이를 통해 호환성이라는 이름으로 절충을 대부분 피할...
private-membership
개인 집합 소속 확인 PSM 문제 설명 개인 집합 소속 확인PSM은 클라이언트가 자신의 식별자가 서버가 보유한 식별자 집합의 구성원인지 여부를 개인정보 보호 방식으로 비공개로 질의할 수 있도록 하는 암호화 프로토콜입니다. 높은 수준에서 PSM은 다음과 같은 개인정보 보호를 보장합니다: 서버는 클라이언트가 질의한 식별자를 평문으로 알 수 없습니다. 서버는 클라이언트의 질의가 소속 여부 결정을 초래하는지 알 수 없습니다. 질의하는 클라이언트는 서버에 저장된 식별자 집합에 대해 자신의 식별자가 서버가 보유한 식별자 집합의 구성원인지...
Amazon Linux 2023 : swiftlang, swiftlang-lib (ALAS2023-2026-2073)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2073 advisory. When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory...
Important: swiftlang
Issue Overview: When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from...
OPENSUSE-SU-2026:11592-1 boringssl-devel-0.20260813-1.1 on GA media
These are all security issues fixed in the boringssl-devel-0.20260813-1.1 package on the GA media of openSUSE Tumbleweed...
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...
GHSA-2MC4-J865-9Q4R netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...
UBUNTU-CVE-2026-69247
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...
swift-crypto: swift-crypto: Denial of Service due to double-free during RSA public key initialization
A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...
swift-crypto: swift-crypto: Denial of Service due to double-free during RSA public key initialization
A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...
CVE-2026-43823
A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...
CVE-2026-43823
When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...
PT-2026-64003
When initializing an RSA public key from DER or PEM bytes throws an error, the EVP PKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...
CVE-2026-48040
The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP RFC 9458 using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for cryptographic operations versions prior to 0.0.22.Final provide a fallback path for direct...
CVE-2026-48040
The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP RFC 9458 using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for cryptographic operations versions prior to 0.0.22.Final provide a fallback path for direct...
CVE-2026-48040 netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access
The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP RFC 9458 using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for cryptographic operations versions prior to 0.0.22.Final provide a fallback path for direct...
Insecure Randomness
Overview Affected versions of this package are vulnerable to Insecure Randomness due to the HKDFexpand and EVPHPKECTXexport functions returning a zero-filled byte array on failure, which is then used as key material for AEAD encryption. An attacker can predict and exploit the deterministic,...
