Gitpaste-12 Worm Targets Linux Servers, IoT Devices

Researchers have uncovered a new worm targeting Linux based x86 servers, as well as Linux internet of things IoT devices that are based on ARM and MIPS CPUs. Of note, the malware utilizes GitHub and Pastebin for housing malicious component code, and has at least 12 different attack modules...

Debian DLA-2433-1 : bouncycastle security update

It was discovered that there was an issue in the bouncycastle crypto library where attackers could obtain sensitive information due to observable differences in its response to invalid input. For Debian 9 'Stretch', this problem has been fixed in version 1.56-1+deb9u3. We recommend that you upgra...

The vulnerability of the Comp Management and Life Cycle Management (RSA BSAFE Crypto-J) software component of the Oracle Application Performance Management software, which is part of the Oracle Enterprise Manager software platform. This vulnerability allows a malicious individual to gain unauthorized access to sensitive information.

The vulnerability of the Comp Management and Life Cycle Management RSA BSAFE Crypto-J software component of the Oracle Application Performance Management software, part of the Oracle Enterprise Manager platform, is related to errors in the use of cryptography. Exploiting this vulnerability can...

kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS

A flaw was found in the Linux kernel. The cryptoreport function mishandles resource cleanup on error. A local attacker able to induce the error conditions could use this flaw to crash the system. The highest threat from this vulnerability is to system availability...

crypto-policies bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

[SECURITY] Fedora 32 Update: fastd-21-1.fc32

fastd is a secure tunneling daemon with some unique features: - Very small binary about 100KB on OpenWRT in the default configuration, including all dependencies besides libc - Exchangable crypto methods - Transport over UDP for simple usage behind NAT - Can run in 1:1 and 1:n scenarios - There a...

[SECURITY] Fedora 31 Update: fastd-21-1.fc31

fastd is a secure tunneling daemon with some unique features: - Very small binary about 100KB on OpenWRT in the default configuration, including all dependencies besides libc - Exchangable crypto methods - Transport over UDP for simple usage behind NAT - Can run in 1:1 and 1:n scenarios - There a...

[SECURITY] Fedora 33 Update: fastd-21-1.fc33

fastd is a secure tunneling daemon with some unique features: - Very small binary about 100KB on OpenWRT in the default configuration, including all dependencies besides libc - Exchangable crypto methods - Transport over UDP for simple usage behind NAT - Can run in 1:1 and 1:n scenarios - There a...

CVE-2020-3690

u'Due to an incorrect SMMU configuration, the modem crypto engine can potentially compromise the hypervisor' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

Code injection

u'Due to an incorrect SMMU configuration, the modem crypto engine can potentially compromise the hypervisor' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

CVE-2020-3690

u'Due to an incorrect SMMU configuration, the modem crypto engine can potentially compromise the hypervisor' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

CVE-2020-3690

CVE-2020-3690 describes that an incorrect SMMU configuration in the modem crypto engine could potentially compromise the hypervisor on Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wired Networking) across listed SoCs (A...

Validation Bypass

xml-crypto is vulnerable to validation bypass. The vulnerability exists through a possible key confusion by injecting a valid HMAC-SHA1 signature, as both HMAC and the public key digital signature methods key shares the same variable...

CVE-2020-25646

A flaw was found in Ansible Collection community.crypto. opensslprivatekeyinfo exposes private key in logs. This directly impacts confidentiality...

xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. Patches Version 2.0.0 has the fix. Workarounds The recommendation is to upgrade. In case that is not possible remove the...

GHSA-C27R-X354-4M68 xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. Patches Version 2.0.0 has the fix. Workarounds The recommendation is to upgrade. In case that is not possible remove the...

Google Golang Crypto Denial of Service (CVE-2020-9283)

A denial-of-service vulnerability exists in Google Golang. Successful exploitation of this vulnerability could cause a denial-of-service condition...

libsrtp security update

CentOS Errata and Security Advisory CESA-2020:3873 An update for libsrtp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

US Dept of Justice steps up legal action against crypto crime

By Uzair Amir Just last month, the department revealed it had arrested two Malaysian and sanctioned two Russians over two separate cases of crypto crime. This is a post from HackRead.com Read the original post: US Dept of Justice steps up legal action against crypto crime...

acme-dns-rust (>=1.0.0, <=1.0.6), aerospike (>=0.4.0, <=1.3.0) +93 more potentially affected by unknown CVE via block-cipher (>=0.7.1, <=0.8.0)

block-cipher CARGO version =0.7.1, =1.0.0, =0.4.0, =0.4.0, =0.7.0, =0.1.0, =0.1.1, =0.1.1, =0.8.1, =0.2.0, =0.5.0, =0.2.0, =0.7.0, =0.8.0 - chacha20 0.5.0 - chacha20poly1305 0.6.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0057...