5548 matches found
CVE-2021-26322
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”...
golang: crypto/elliptic: incorrect operations on the P-224 curve
A flaw detected in golang: crypto/elliptic, in which P-224 keys as generated can return incorrect inputs, reducing the strength of the cryptography. The highest threat from this vulnerability is confidentiality and integrity...
ALBA-2021:4443 python-cryptography bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...
python-cryptography bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...
python-cryptography bug fix and enhancement update
An update is available for python-cryptography. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rock...
RLSA-2021:4424 Moderate: openssl security and bug fix update
OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: integer overflow in CipherUpdate CVE-2021-23840 openssl: NULL pointer dereference in...
ALSA-2021:4409 Moderate: libgcrypt security and bug fix update
The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpipowm CVE-2021-33560 For more details about the security issue...
Moderate: libgcrypt security and bug fix update
The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpipowm CVE-2021-33560 For more details about the security issue...
Predicting the Next OWASP API Security Top 10
As a long-time OWASP member and application security practitioner, I wanted to share my thoughts on how the newly released OWASP Web App Top 10 might impact or influence the updates to the API Security Top 10, last released back in December 2019. These lists cover the most common causes for...
Microsoft Windows CryptoAPI Spoofing Vulnerability
Microsoft Windows CryptoAPI Crypt32.dll contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography ECC certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was fro...
NewStart CGSL MAIN 6.02 : gnutls Vulnerability (NS-SA-2021-0133)
The remote NewStart CGSL host, running version MAIN 6.02, has gnutls packages installed that are affected by a vulnerability: - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve...
F5 Networks BIG-IP : Nettle cryptography library vulnerability (K33101555)
The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K33101555 advisory. - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA,...
NewStart CGSL MAIN 6.02 : nettle Vulnerability (NS-SA-2021-0132)
The remote NewStart CGSL host, running version MAIN 6.02, has nettle packages installed that are affected by a vulnerability: - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve...
CVE-2020-14264
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"...
CVE-2020-14264
"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"...
CVE-2021-38461
The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries...
sodiumoxide is deprecated
Alternatives may be found - not in any specific order: - libsodium-sys-stable - dryoc - RustCrypto/nacl-compat cryptobox, cryptokx, cryptosecretstream - RustCrypto/xsalsa20poly1305 cryptosecretbox - Signatory - ed25519-compact - ed25519-dalek - ring Recommendations can be also found from: - Aweso...
Security Risks of Client-Side Scanning
Even before Apple made its announcement, law enforcement shifted their battle for backdoors to client-side scanning. The idea is that they wouldnt touch the cryptography, but instead eavesdrop on communications and systems before encryption or after decryption. Its not a cryptographic backdoor, b...
Juniper Junos OS Vulnerability (JSA11245)
The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11245 advisory. - python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS1 v1.5 ciphertext. CVE-2020-25659 Note...