Timing Side-Channel in Vault’s Userpass Auth Method

Summary A timing side channel in Vault and Vault Enterprise’s “Vault” userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s userpass auth method. This vulnerability, identified as CVE-2025-6011, is...

RHSA-2023:5221

creationtimestamp| type| source ---|---|--- 2025-08-01 16:45:01+00:00| seen| Telegram/xc3vkOd00NlphTo8oCaHSNQmEDCJCvPNfenHNFoNBmcoi4...

RHSA-2023:7551

creationtimestamp| type| source ---|---|--- 2025-08-01 16:44:59+00:00| seen| Telegram/UvvK5lpUqP5-AKrc2HE3kUs7WF2Bdb-mYHzHriMNu4GQwA...

SUSE-SU-2025:20530-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2023-5992: Fixed side-channel leaks while stripping encryption PKCS1 padding bsc1219386...

Security update for opensc

This update for opensc fixes the following issues: CVE-2023-5992: Fixed side-channel leaks while stripping encryption PKCS1 padding bsc1219386 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you...

Security update for libgcrypt

This update for libgcrypt fixes the following issues: CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts bsc1221107. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

HashiCorp Vault Community Edition和HashiCorp Vault Enterprise 安全漏洞

HashiCorp Vault Enterprise and HashiCorp Vault Community Edition are both products of HashiCorp, Inc. of the U.S. HashiCorp Vault Enterprise is an enterprise information archiving platform.HashiCorp Vault HashiCorp Vault Enterprise is an enterprise information archiving platform, and HashiCorp...

PT-2025-31679

Name of the Vulnerable Software and Affected Versions Vault versions prior to 1.20.1 Vault Enterprise versions prior to 1.20.1 Vault Enterprise version 1.19.7 Vault Enterprise version 1.18.12 Vault Enterprise version 1.16.23 Description A timing side channel in the userpass authentication method...

CVE-2025-6011: Observable Discrepancy

A timing side channel in Vault and Vault Enterprise’s “Vault” userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise...

CVE-2025-37111

creationtimestamp| type| source ---|---|--- 2025-07-31 20:47:46+00:00| seen| Telegram/Bwwh6OZkMld2uycyR1juxFwY78XACyPPIY5hWOmgkhOrtcw...

Security update for libgcrypt

This update for libgcrypt fixes the following issues: CVE-2024-2236: Fixed timing based side-channel in RSA implementation bsc1221107 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run t...

UNC2891 Breaches ATM Network via 4G Raspberry Pi, Tries CAKETAP Rootkit for Fraud

The financially motivated threat actor known as UNC2891 has been observed targeting Automatic Teller Machine ATM infrastructure using a 4G-equipped Raspberry Pi as part of a covert attack. The cyber-physical attack involved the adversary leveraging their physical access to install the Raspberry P...

SUSE-SU-2025:20538-1 Security update for libgcrypt

This update for libgcrypt fixes the following issues: - CVE-2024-2236: Fixed timing based side-channel in RSA implementation bsc1221107...

RHSA-2024:3627

creationtimestamp| type| source ---|---|--- 2025-07-30 16:46:47+00:00| seen| Telegram/UDN0QHyNz5DHh55Gig1ta7SvJvNsTgD9scj3uks4Mo4aIs...

CVE-2024-45515

creationtimestamp| type| source ---|---|--- 2025-07-30 14:46:01+00:00| seen| Telegram/BRRBIyK4OV-WtT9ild-ioUS4RzAM1cRMDhNbT1kfFRaVU...

Medium: perl-Crypt-OpenSSL-RSA

Issue Overview: A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial...

POLARIS: Explainable Artificial Intelligence for Mitigating Power Side-Channel Leakage

Microelectronic systems are widely used in many sensitive applications e.g., manufacturing, energy, defense. These systems increasingly handle sensitive data e.g., encryption key and are vulnerable to diverse threats, such as, power side-channel attacks, which infer sensitive data through dynamic...

Stable Channel Update for Desktop

The Stable channel has been updated to 138.0.7204.183/.184 for Windows, Mac and 138.0.7204.183 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept...

SUSE CVE-2025-38486

In the Linux kernel, the following vulnerability has been resolved: soundwire: Revert "soundwire: qcom: Add setchannelmap api support" This reverts commit 7796c97df6b1b2206681a07f3c80f6023a6593d5. This patch broke Dragonboard 845c sdm845. I see: Unexpected kernel BRK exception at EL1 Internal...

GO-2025-3772 Mattermost allows unauthorized channel member management through playbook runs in github.com/mattermost/mattermost-server

Mattermost allows unauthorized channel member management through playbook runs in github.com/mattermost/mattermost-server...