CVE-2023-38730

IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 262268...

PT-2023-26578 · Ibm · Ibm Storage Copy Data Management

Name of the Vulnerable Software and Affected Versions: IBM Storage Copy Data Management versions 2.2.0.0 through 2.2.19.0 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information...

Fedora 38 : python-yfinance (2023-2b0f2e4bc3)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2b0f2e4bc3 advisory. Update to 0.2.28 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

python-cryptography: memory corruption via immutable objects

A vulnerability was found in python-cryptography. In affected versions, Cipher.updateinto would accept Python objects which implement the buffer protocol but provide only immutable buffers. This issue allows immutable objects such as bytes to be mutated, thus violating the fundamental rules of...

CISA, NSA, and NIST Publish Factsheet on Quantum Readiness

Today, the Cybersecurity and Infrastructure Security Agency CISA, National Security Agency NSA and National Institute of Standards and Technology NIST released a joint factsheet, Quantum-Readiness: Migration to Post-Quantum Cryptography PQC, to inform organizations—especially those that support...

[SECURITY] Fedora 38 Update: libreswan-4.12-1.fc38

Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...

[SECURITY] Fedora 37 Update: libreswan-4.12-1.fc37

Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...

CVE-2023-39908

The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory...

CVE-2023-38325

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options...

Weak Cryptography

github.com/supranational/blst is vulnerable to Weak Cryptography. The vulnerability exists due to logic errors in SigValidate function which results in group-check omission...

CLSA-2023-1691576279 Fix CVE(s): CVE-2023-38408

SECURITY UPDATE: helper programs can dlopen/dlclose any libraries from /usr/lib - debian/patches/CVE-2023-38408-Ensure-FIDO-PKCS11-libraries-contain-expect.patch: checks libraries before dlopen - debian/patches/CVE-2023-38408-Separate-ssh-pkcs11-helpers-for-each-p11-mo.patch: separate...

Lindell17 TSS Injection Vulnerability

tss-lib is an open source IO FinNet implementation of the multi-party t,n- threshold ECDSA Elliptic Curve Digital Signature Algorithm based on Gennaro and Goldfeder 20201 and EdDSA Edwards Curve Digital Signature Algorithm. A security vulnerability exists in Lindell17 TSS that stems from allowing...

PT-2023-18919 · Hcl · Hcl Dryice Iautomate

Name of the Vulnerable Software and Affected Versions: HCL DRYiCE iAutomate affected versions not specified Description: The issue is related to the use of a broken cryptographic algorithm, which can potentially allow an attacker to compromise the confidentiality and integrity of sensitive...

CVE-2023-39533

CVE-2023-39533 affects the Go libp2p core/crypto implementation (Noise handshake and x509 verification) where malicious peers can force a resource exhaustion by using large RSA keys. The issue is mitigated by restricting RSA keys to

You Can’t Rush Post-Quantum-Computing Cryptography Standards

I just read an article complaining that NIST is taking too long in finalizing its post-quantum-computing cryptography standards. This process has been going on since 2016, and since that time there has been a huge increase in quantum technology and an equally large increase in quantum understandi...

nodejs: DiffieHellman do not generate keys after setting a private key

A vulnerability has been identified in the Node.js, where a generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet...

The vulnerability of the Data Transfer Security function in software for creating and managing graphical interfaces for control panels in GT Designer3, GOT2000 Series, GOT SIMPLE Series, GT SoftGOT2000, allows a perpetrator to gain unauthorized access to protected information and enhance their privileges.

The vulnerability of the Data Transfer Security function in software for creating and managing graphical interfaces for control panels in GT Designer3, GOT2000 Series, GOT SIMPLE Series, and GT SoftGOT2000 is related to weak cryptography for passwords. Exploiting this vulnerability can allow...

CVE-2023-3180

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtiocryptohandlesymreq. There is no check for the value of srclen and dstlen in virtiocryptosymophelper, potentially leading to a heap buffer overflow when the two values differ...

Dependency On Vulnerable Third-Party Component

cryptography contains a Dependency On a Vulnerable Third-Party Component. The use of the bundled OpenSSL component which contains several security issues which allows an attacker to disrupt secure operations in the library. Only users installing from wheels built by the cryptography pip library a...

PT-2023-4152 · Mitsubishi · Gt Softgot2000 +3

Name of the Vulnerable Software and Affected Versions: GT Designer3 versions affected versions not specified GOT2000 Series versions affected versions not specified GOT SIMPLE Series versions affected versions not specified GT SoftGOT2000 versions affected versions not specified Description: The...