Wrong And Predictable Encryption

github.com/golang/crypto is vulnerable to predictable encryption. In the keystream generation of more than 256 GiB in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa, it can first generate incorrect output and finally cycling back to the previously...

CVE-2019-4156

IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158572...

Hackers Used Two Firefox Zero Days to Hit a Crypto Exchange

A ransomware haul, a border security leak, and more of the week's top security news...

This Cryptomining Malware Launches Linux VMs On Windows and macOS

Cybersecurity researchers from at least two firms today unveiled details of a new strain of malware that targets Windows and macOS systems with a Linux-based cryptocurrency mining malware. It may sound strange, but it's true. Dubbed "LoudMiner" and also "Bird Miner," the attack leverages...

HTTPS client certificate authentication security issues. Part 2/3

In the first story, I described some issues related to client certificates authentication implementations in environments with load balancers. This time I’d like to mention some typical issues in custom certificate validation processes when a developer is doing this itself in application code...

The vulnerability of the EAP-PWD protocol for certifying wireless communication devices arises from the use of cryptographic algorithms that contain defects. This allows attackers to install and run applications or gain access to confidential data.

The vulnerability of the EAP-PWD protocol for certifying wireless communication devices with WPA is related to templates in memory that are accessible from the general cache. Exploiting this vulnerability allows a remote attacker to install and run the application, as well as compromise the...

Low: Red Hat Security Advisory: kernel-alt security and bug fix update

An update for kernel-alt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

OPENSUSE-SU-2019:1506-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2019-5736: containerd: Fixing container breakout vulnerability bsc1121967. - CVE-2019-6486: go security release, fixing crypto/elliptic CPU...

Fedora Update for cryptopp FEDORA-2019-812b77ed2e

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: cryptopp-8.2.0-1.fc30

Crypto++ Library is a free C++ class library of cryptographic schemes. See http://www.cryptopp.com/ for a list of supported algorithms. One purpose of Crypto++ is to act as a repository of public domain not copyrighted source code. Although the library is copyrighted as a compilation, the...

PT-2019-16996 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations: For versio...

Crypto tumbler BestMixer.io seized for large-scale money laundering

By Uzair Amir BestMixer.io was among the three largest cryptocurrency mixing services launched in May 2018. Europol in collaboration with the Dutch Fiscal Information and Investigative Service FIOD, Luxembourg has shut down a well-known and one of the world’s leading cryptocurrency tumblers...

This Week in Security News: Unsecured Servers and Vulnerable Processors

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about vulnerabilities that can allow hackers to retrieve data from CPUs and mine cryptocurrency. Read on: May’s Patch Tuesday Include...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20190514) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Security Fixes : - A flaw was found in the implementation of the 'fill buffer', a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data fro...

SUSE-SU-2019:1234-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2019-5736: containerd: Fixing container breakout vulnerability bsc1121967. - CVE-2019-6486: go security release, fixing crypto/elliptic CPU...

EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1557)

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that ntpd did not check whether a Message Authentication Code MAC was present in a received packet when ntpd was...

EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1556)

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause...

Sim swapping hackers charged with stealing $2.5m worth of crypto

By Uzair Amir These hackers are part of the group called "The Community." According to an announcement made by the U.S. Department of Justice DoJ, six men have been charged for SIM swapping fraud that resulted in the theft of nearly $2.5 million $2,416,352 worth of cryptocurrency. The six men are...

EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1485)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way the Linux kernel's Crypto subsystem handled automatic loading of kernel modules. A local user could u...

EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1471)

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - drivers/hid/hid-zpff.c in the Human Interface Device HID subsystem in the Linux kernel through 3.11, when...