LibTomCrypt Security Vulnerability

LibTomCrypt is a modular portable cryptographic tool that focuses on block ciphers, one-way hash functions, linking patterns and pseudo-random number generators for developers. A security vulnerability exists in LibTomCrypt versions prior to 0.062, which stems from a security flaw in the function...

GO-2022-0968 Panic on malformed packets in golang.org/x/crypto/ssh

Unauthenticated clients can cause a panic in SSH servers. When using AES-GCM or ChaCha20Poly1305, consuming a malformed packet which contains an empty plaintext causes a panic...

x/crypto/ssh vulnerable to panic via malformed packets

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an unauthenticated attacker to panic an SSH server. When using AES-GCM or ChaCha20Poly1305, consuming a malformed packet which contains an empty plaintext causes a panic...

GHSA-GWC9-M7RH-J2WW x/crypto/ssh vulnerable to panic via malformed packets

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an unauthenticated attacker to panic an SSH server. When using AES-GCM or ChaCha20Poly1305, consuming a malformed packet which contains an empty plaintext causes a panic...

RUSTSEC-2019-0029 ChaCha20 counter overflow can expose repetitions in the keystream

The ChaCha20 stream cipher can produce a maximum of 2^32 blocks 256GB before the 32-bit counter overflows. Releases of the chacha20 crate prior to v0.2.3 allow generating keystreams larger than this, including seeking past the limit. When this occurs, the keystream is duplicated, with failure mod...

ChaCha20 counter overflow can expose repetitions in the keystream

The ChaCha20 stream cipher can produce a maximum of 2^32 blocks 256GB before the 32-bit counter overflows. Releases of the chacha20 crate prior to v0.2.3 allow generating keystreams larger than this, including seeking past the limit. When this occurs, the keystream is duplicated, with failure mod...

openldap security, bug fix, and enhancement update

2.4.44-5 - fix CVE-2017-9287 openldap: Double free vulnerability in servers/slapd/back-mdb/search.c 1458210 2.4.44-4 - NSS: Include some CHACHA20POLY1305 ciphers 1432907 2.4.44-3 - NSS: re-register NSSShutdown callback 1405354 2.4.44-2 - Include MDB tools in openldap-servers 1428740 2.4.44-1 -...