jfrog-CVE-2022-21449

CVE-2022-21449 概述 该工具允许对编译后的代码归档文件（.jar、.war 等）进行快速扫描，通过查找指示使用 ECDSA 算法的字符串，以检查是否存在 CVE-2022-21449 漏洞。该工具使用 Python3，无需额外依赖。 用法 python cve202221449.py root-folder -quiet -exclude folder1 folder2 .. 或 python cve202221449.py root-archive -quiet -exclude folder1 folder2 .. 该工具将递归扫描 rootfolder 中的 .jar...

AIS3-2024-Project-D5Team

AIS3-2024-Project-TeamD5 Reappear-CVE-2022-21449-TLS-PoC 首先開始之前 我想感謝與致敬一些人 1 Neil Madden ; 發現並揭露 CVE-2022-21449, 這是他出色的 WriteUp 2 Khaled Nassar ; 完成 PoC 方便 Demo 3 育正葛葛的資安遊樂場 ; 使用淺顯易懂的方式利用YT影片描述此 CVE 4 AIS3的D組助教們 ; 感謝專題中各種 想法/資源/技術 支援 感謝上述的大神資源與支援 很強大的學習榜樣 AIS3 Team D5 表示感謝 ! HackMDTeamD5 共筆按我即可飛...

CVE-2022-21449-vuln-test

CVE-2022-21449 漏洞测试工具 简介 Java 中新增了一个 CVE-2022-21449，该漏洞存在于 ECDSA 签名验证中。它是 JWT 等场景使用的算法之一。引用博客内容： 如果你在生产环境中部署了 Java 15、Java 16、Java 17 或 Java 18，应立即停止当前操作， 并立即更新以安装 2022 年 4 月关键补丁更新中的修复程序。 运行方式 ./gradlew package && java -jar target/vulntest.jar 如果用于运行该工具的 JVM 存在签名验证漏洞，则会显示 VULNERABLE，否则显示 not...

CVE-2022-21449-TLS-PoC

CVE-2022-21449-TLS-PoC CVE-2022-21449 también denominadas Psychic Signatures en el análisis de la vulnerabilidad realizado por Neil Madden Prueba de concepto que demuestra su uso con un cliente vulnerable y un servidor TLS malicioso. El servidor malicioso presenta una cadena de certificados válid...

CVE-2022-21449-showcase

演示程序，展示CVE-2022-21449 请在JDK 17.0.0下运行 哦对了，这是截图...

CVE-2022-21449

Este repositorio no tiene un README...

psychic-signatures

CVE-2022-21449：Java 中的心灵签名...

CVE-2022-21449

CVE-2022-21449 用于检测针对 TLS 客户端的 CVE-2022-21449 利用尝试的 Zeek 脚本。仅适用于 TLS 1.2 及以下版本。 安装 zkg install https://github.com/thack1/CVE-2022-21449 运行 对提供的 pcap 文件运行： $ zeek -Cr pcaps/CVE-2022-21449.pcap CVE-2022-21449 示例通知 separator \x09 setseparator , emptyfield empty unsetfield - path notice open...

CVE-2022-21449

CVE 2022 21449 python 实现 该项目允许： 在有限域或非有限域上绘制具有所需参数的椭圆曲线 从给定的椭圆曲线生成密钥对 使用 ECIES 加密/解密消息 使用 ECDSA 签名/验证 模拟 CVE 2022 21449 的利用 文件位置 doc/ 该文件夹中的所有文件都是临时的，最终将汇总到单个文件中 doc/Introduction à la cryptographie asymétrique.pdf 此 PDF 包含本项目所依据的理论：非对称密码学、签名、椭圆曲线、ECIES。使用的来源在文档末尾引用。 doc/Les fonctions de hachage -...

SignChecker

SignChecker 用于演示 CVE-2022-21449 漏洞的测试工具。...

K32172755: Multiple Java vulnerabilities CVE-2022-21426, CVE-2022-21434, CVE-2022-21443, CVE-2022-21476, and CVE-2022-21496

Security Advisory Description CVE-2022-21426 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5,...

AlmaLinux 9 : java-17-openjdk (ALSA-2022:1729)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1729 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Java is used by IBM Robotic Process Automation for Cloud Pak as part of several container services that run Java applications. Vulnerability Details CVEID:CVE-2022-21496 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated...

RHEL 9 : java-17-openjdk (RHSA-2022:1729)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1729 advisory. The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixe...

SUSE: Security Advisory (SUSE-SU-2022:2650-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for java-1_8_0-ibm (SUSE-SU-2022:2650-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE: Security Advisory (SUSE-SU-2022:2540-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2022:2539-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:2540-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 7 Fix Pack 10 bsc1201643, including fixes for: - CVE-2022-21476 bsc1198671, CVE-2022-21449 bsc1198670, CVE-2022-21496 bsc1198673, CVE-2022-21434 bsc1198674, CVE-2022-21426 bsc1198672, CVE-2022-21443...

OESA-2022-1702 openjdk-latest security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2...