openssl security update

An update is available for openssl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transpo...

Oracle Linux 8 : python39:3.9 / and / python39-devel:3.9 (ELSA-2024-8359)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8359 advisory. modwsgi numpy python39 3.9.20-1 - Update to 3.9.20 Resolves: RHEL-60007 python3x-pip python3x-setuptools python3x-six python-cffi python-chardet...

Replaced by `pqcrypto-mldsa`

This crate has been replaced by pqcrypto-mldsa, which provides a FIPS204-compatible implementation of ML-DSA...

python39:3.9 and python39-devel:3.9 security update

modwsgi numpy python39 3.9.20-1 - Update to 3.9.20 Resolves: RHEL-60007 python3x-pip python3x-setuptools python3x-six python-cffi python-chardet python-cryptography python-idna python-lxml python-ply python-psutil python-psycopg2 python-pycparser python-PyMySQL python-pysocks python-requests...

No, The Chinese Have Not Broken Modern Encryption Systems with a Quantum Computer

The headline is pretty scary: "China's Quantum Computer Scientists Crack Military-Grade Encryption." No, it's not true. This debunking saved me the trouble of writing one. It all seems to have come from this news article, which wasn't bad but was taken widely out of proportion. Cryptography is...

SUSE CVE-2024-50047

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption large read crashes with a slab-use-after-free way down in the crypto API. Reproducer: mount.cifs -o ...,seal,esize=1 //srv/share /mnt dd if=/mnt/largefile...

PT-2024-10544 · Ibm · Storage Protect Backup-Archive Client +1

Name of the Vulnerable Software and Affected Versions: IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client versions 8.1.0.0 through 8.1.23.0 Description: The issue is related to the use of weaker than expected cryptographic algorithms...

DLA-3922-1 python-cryptography - security update

Bulletin has no description...

Debian dla-3922 : python-cryptography-doc - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3922 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3922-1 [email protected]...

OpenSSL OOB Memory Access Vulnerability (20241016) - Linux

OpenSSL is prone to an out of bound OOB memory access vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Debian: Security Advisory (DLA-3922-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3922-1] python-cryptography security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3922-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk October 17, 2024 https://wiki.debian.org/LTS -...

CVE-2024-9143 Low-level invalid GF(2^m) parameters lead to OOB memory access

Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution,...

CVE-2024-9143 Low-level invalid GF(2^m) parameters lead to OOB memory access

Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution,...

CVE-2024-9143

CVE-2024-9143 describes a vulnerability in OpenSSL: using low-level GF(2^m) ECC APIs with untrusted explicit field-polynomial values can cause out-of-bounds memory reads/writes, potentially crashing an application or enabling remote code execution. Affected are APIs like EC_GROUP_new_curve_GF2m()...

OpenSSL 3.1.0 < 3.1.8 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.1.8. It is, therefore, affected by a vulnerability as referenced in the 3.1.8 advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-boun...

OpenSSL 3.2.0 < 3.2.4 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.2.4. It is, therefore, affected by a vulnerability as referenced in the 3.2.4 advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-boun...

OpenSSL 3.3.0 < 3.3.3 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.3.3. It is, therefore, affected by a vulnerability as referenced in the 3.3.3 advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-boun...

OpenSSL 1.0.2 < 1.0.2zl Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.2zl. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zl advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...

OpenSSL 1.1.1 < 1.1.1zb Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.1.1zb. It is, therefore, affected by a vulnerability as referenced in the 1.1.1zb advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...