Double free after calling PEM_read_bio_ex

...

GHSA-W7PP-M8WF-VJ6R Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf

Previously, Cipher.updateinto would accept Python objects which implement the buffer protocol, but provide only immutable buffers: pycon outbuf = b"\x00" 32 c = ciphers.CipherAESb"\x00" 32, modes.ECB.encryptor c.updateintob"\x00" 16, outbuf 16 outbuf...

cryptography 代码问题漏洞

python-cryptography is a Python code library for cryptographic applications from the Cryptographic team. A code issue vulnerability exists in cryptography. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

CVE-2021-26407

A randomly generated Initialization Vector IV may lead to a collision of IVs with the same key potentially resulting in information disclosure...

openssl security update

An update is available for openssl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transpo...

AZL-43341 CVE-2021-43565 affecting package cri-o for versions less than 1.22.3-5

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...

golang: crypto/elliptic: IsOnCurve returns true for invalid field elements

A flaw was found in the elliptic package of the crypto library in golang when the IsOnCurve function could return true for invalid field elements. This flaw allows an attacker to take advantage of this undefined behavior, affecting the availability and integrity of the resource...

golang: crypto/elliptic: panic caused by oversized scalar

An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to use a crafted scaler input longer than 32 bytes, causing P256.ScalarMult or P256.ScalarBaseMult to panic, leading to a loss of availability...

Western Digital Sweet B 安全漏洞

Western Digital Sweet B is a library from Western Digital, Inc. that implements public key elliptic curve cryptography ECC using NIST P-256 and SECG secp256k1 curves. A security vulnerability exists in the Western Digital Sweet B library that stems from the fact that when a shared key or dot...

GHSA-Q3CJ-2R34-2CWC Improper input validation in cryptography

HKDF in cryptography before 1.5.3 returns an empty byte-string if used with a length less than algorithm.digestsize...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CLSA-2022-1647550273 Fix of CVE: CVE-2022-0778

CVE-2022-0778: Fix possible infinite loop in BNmodsqrt...

CVE-2022-0778 Infinite loop in BN_mod_sqrt() reachable when parsing certificates

The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a...

PT-2022-6958

Name of the Vulnerable Software and Affected Versions golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go golang.org/x/crypto/ssh versions through 1.16.15 golang.org/x/crypto/ssh versions 1.17.x through 1.17.8 Description The issue is related to the use of defective...

AZL-79100 CVE-2022-23806 affecting package golang 1.25.7-1

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element...

GHSA-9HFG-PXR6-Q4VP Use of a Broken or Risky Cryptographic Algorithm in crypto2

The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to std::slice::fromrawpartsmut, which breaks the contract and introduces undefined behavior. This affects Chacha20 encryption and decryption in crypto2...

Incorrect Calculation in the MSR JavaScript Cryptography Library

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library's Elliptic Curve Cryptography ECC implementation.An attacker could potentially abuse these bugs to learn information about a server's private ECC key a key...

F5 Networks BIG-IP : Nettle cryptography library vulnerability (K33101555)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K33101555 advisory. - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA,...

GHSA-2WC6-2RCJ-8V76 scalarmult() vulnerable to degenerate public keys

The scalarmult function included in previous versions of this crate accepted all-zero public keys, for which the resulting Diffie-Hellman shared secret will always be zero regardless of the private key used. This issue was fixed by checking for this class of keys and rejecting them if they are us...