49 matches found
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
AZL-76665 CVE-2025-68121 affecting package msft-golang for versions less than 1.24.12-1
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the...
AZL-76662 CVE-2025-68121 affecting package golang for versions less than 1.25.6-1
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the...
AZL-98847 CVE-2025-68121 affecting package golang 1.27.1-1
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the...
EUVD-2025-206854
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the...
CVE-2025-68121
CVE-2025-68121 affects crypto/tls in Go where session resumption can succeed if the underlying Config is mutated between the initial and resumed handshake (e.g., after Config.Clone or GetConfigForClient mutates ClientCAs/RootCAs). The connected advisories tie this issue to the same CVE across mul...
Malicious code in riya-23 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 997e79affec697620be096b69d403874e8eb3fa14c1df8fe03eee548a954cbf3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...