GSD-2022-1003431 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.45 by commit...

GSD-2022-1003165 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.13 by commit...

GSD-2022-1002851 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.2 by commit...

GSD-2022-1002526 heap buffer overflow in OpenSSL version 3.0.4

In OpenSSL version 3.0.4 a heap buffer overflow exists in the AVX512 support that can be attacked via network resulting in code execution. This is reachable via four code paths: RSAZ 1024, RSAZ 512, Dual 1024 RSAZ, and Default constant-time Montgomery modular exponentiation. Please note this issu...

PT-2022-31909

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.120 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

PT-2022-32178

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.246 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

PT-2022-31428

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.13 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time, potentially leading to security vulnerabilities. The actual impact and attack plausibility have no...

PT-2022-32045

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.197 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

PT-2022-32269

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.282 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

PT-2022-31114

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.2 Description The issue concerns the dm crypt feature in the Linux Kernel, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual...

PT-2022-31694

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.45 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time, potentially leading to security vulnerabilities. The actual impact and attack plausibility have no...

PT-2022-32351

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.317 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

New Hertzbleed Side Channel Attack Affects All Modern AMD and Intel CPUs

A newly discovered security vulnerability in modern Intel and AMD processors could let remote attackers steal encryption keys via a power side channel attack. Dubbed Hertzbleed by a group of researchers from the University of Texas, the University of Illinois Urbana-Champaign, and the University ...

GHSA-2X4V-G8CX-JXRQ Login timing attack in ibexa/core

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

Login timing attack in ibexa/core

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

Login timing attack in ezsystems/ezpublish-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

GHSA-XFQG-P48G-HH94 Login timing attack in ezsystems/ezpublish-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

Login timing attack in ezsystems/ezplatform-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

GHSA-8VXV-2G8P-2249 Observable Timing Discrepancy in totp-rs

Impact Token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless. Patches Library now used constant-time comparison. Workarounds No. For more...

Observable Timing Discrepancy in totp-rs

Impact Token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless. Patches Library now used constant-time comparison. Workarounds No. For more...