CVE-2023-33850

IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive...

golang: crypto/tls: large handshake records may cause panics

A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specially-crafted TLS handshake records, a remote, authenticated attacker can cause a denial of service condition...

golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results

A flaw was found in the crypto/internal/nistec golang library. The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars, such as a scalar larger than the order of the curve. This does not impact usages of crypto/ecds...

golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results

A flaw was found in the crypto/internal/nistec golang library. The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars, such as a scalar larger than the order of the curve. This does not impact usages of crypto/ecds...

Debian: Security Advisory (DSA-1969-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

golang.org/x/crypto: empty plaintext packet causes panic

There's an input validation flaw in golang.org/x/crypto's readCipherPacket function. An unauthenticated attacker who sends an empty plaintext packet to a program linked with golang.org/x/crypto/ssh could cause a panic, potentially leading to denial of service...

CVE-2020-35169

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulnerability...

io.github.comet-crypto:lib (>=0.2 <=0.2.3), io.socket:socket.io-server (>=3.0.0 <=3.0.1) potentially affected by CVE-2022-25867 via io.socket:socket.io-client (=2.0.0)

io.socket:socket.io-client MAVEN version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.socket:socket.io-client and may be impacted: - io.github.comet-crypto:lib =0.2, =3.0.0, =3.0.1 Source cves: CVE-2022-25867 Source advisory:...

User Impersonation

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to User Impersonation. Go Vulnerability Report: in the crypto/tls process when SessionTicketsDisabled is enabled. An attacker can impersonate clients by spoofing client...

Exploit for CVE-2022-21449

CVE-2022-21449-TLS-PoC CVE-2022-21449 also dubbed Psychic Si...

CLSA-2022-1647550603 Fix CVE(s): CVE-2022-0778

SECURITY UPDATE: Infinite loop in BNmodsqrt - debian/patches/CVE-2022-0778.patch: fix infinite loop in crypto/bn/bnsqrt.c. - CVE-2022-0778...

OPENSUSE-SU-2022:0723-1 Security update for go1.17

This update for go1.17 fixes the following issues: - CVE-2022-23806: Fixed incorrect returned value in crypto/elliptic IsOnCurve bsc1195838. - CVE-2022-23772: Fixed overflow in Rat.SetString in math/big can lead to uncontrolled memory consumption bsc1195835. - CVE-2022-23773: Fixed incorrect acce...

RUSTSEC-2022-0011 Miscomputation when performing AES encryption in rust-crypto

The following Rust program demonstrates some strangeness in AES encryption - if you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. For these functions, we expect that extending a 16 byte key to a 32 byte k...

CVE-2022-23806

A flaw was found in the elliptic package of the crypto library in golang when the IsOnCurve function could return true for invalid field elements. This flaw allows an attacker to take advantage of this undefined behavior, affecting the availability and integrity of the resource...

CVE-2021-33147

The CVE-2021-33147 issue affects the Intel IPP Cryptography library prior to 2021.2. Affected component: Intel IPP Crypto library (before 2021.2). Root cause: improper conditions check may allow an authenticated user to cause information disclosure via local access. Impact: confidentiality exposu...

Intel Integrated Performance Primitives 代码问题漏洞

Intel Integrated Performance Primitives IPP is a suite of programming tools for working with images, signal processing, and data from Intel Corporation USA. A code issue vulnerability exists in the Intel Integrated Performance Primitives Crypto library that stems from a potential security hole in...

Mageia: Security Advisory (MGASA-2017-0010)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for botan2 (FEDORA-2021-8d51cac49f)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: botan2-2.17.3-4.fc34

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

Fedora: Security Advisory for botan2 (FEDORA-2021-14b0d97496)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...