7785 matches found
UBUNTU-CVE-2023-6258
A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards PKCS11. If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS1 1.5...
CVE-2023-6258
A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards PKCS11. If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS1 1.5...
CVE-2023-6258 Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths
A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards PKCS11. If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS1 1.5...
CVE-2023-6258
A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards PKCS11. If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS1 1.5...
GO-2024-2451 IV collision in github.com/bincyber/go-sqlcrypter
There is a risk of an IV collision using the awskms or aesgcm provider. NIST SP 800-38D section 8.3 states that it is unsafe to encrypt more than 2^32 plaintexts under the same key when using a random IV. The limit could easily be reached given the use case of database column encryption...
pkcs11-provider security vulnerability
pkcs11-provider is an oasis-open open source Openssl 3.x provider for accessing hardware or software tokens using the PKCS11 cryptographic token interface. A security vulnerability exists in pkcs11-provider, which stems from a Bleichenbacher-like security flaw in the application that could cause ...
CVE-2023-6258: Improper Protection of Physical Side Channels
A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards PKCS11. If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS1 1.5...
PT-2024-14916 · Unknown · Pkcs11-Provider
Name of the Vulnerable Software and Affected Versions: pkcs11-provider affected versions not specified Description: A security issue has been identified in the pkcs11-provider, associated with Public-Key Cryptography Standards PKCS11. If exploited, this could result in a Bleichenbacher-like...
SUSE CVE-2024-0914
A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key...
CVE-2024-0914
A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key. Mitigation Mitigation...
PT-2024-20005
Name of the Vulnerable Software and Affected Versions Dex version 2.37.0 Description Dex is an identity service that uses OpenID Connect to drive authentication for other apps. The issue arises from Dex serving HTTPS with insecure TLS 1.0 and TLS 1.1. The tlsConfig is ignored after the introducti...
openCryptoki Security Vulnerability
openCryptoki is openCryptoki open source a PKCS11 library and tool for Linux. A security vulnerability exists in openCryptoki that stems from the discovery of a timing side channel vulnerability when processing RSA PKCS1 v1.5 padded ciphertexts. This flaw could also lead to unauthorized decryptio...
dex Security Vulnerabilities
dex is an identity service that uses OpenID Connect to drive authentication for other applications. A security vulnerability exists in versions of dex prior to 2.38.0 that stems from the use of insecure TLS 1.0 and TLS 1.1 to provide HTTPS, which can be exploited by an attacker to decrypt TLS 1.0...
Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client
...
Ubuntu: Security Advisory (USN-6595-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-6595-1 pycryptodome vulnerability
It was discovered that PyCryptodome had a timing side-channel when performing OAEP decryption. A remote attacker could possibly use this issue to recover sensitive information...
USN-6595-1: PyCryptodome vulnerability
It was discovered that PyCryptodome had a timing side-channel when performing OAEP decryption. A remote attacker could possibly use this issue to recover sensitive information...
CVE-2024-23218
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...
CVE-2024-23218
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...
CVE-2024-23218
CVE-2024-23218 : A timing side-channel in CoreCrypto could allow decrypting legacy RSA PKCS#1 v1.5 ciphertexts without the private key. Apple patched this in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, and iOS/iPadOS 17.3. The connected sources corroborate the vulnerability and the listed fixes; ...