CVE-2020-4614

CVE-2020-4614 affects IBM Data Risk Manager (iDNA) 2.0.6. The issue is weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. Remediation is to upgrade to v2.0.6.4 and then apply subsequent fixpacks (2.0.6.5, 2.0.6.6) in order, as detailed in ...

CVE-2020-4614: Use of a Broken or Risky Cryptographic Algorithm

IBM Data Risk Manager iDNA 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 184927...

CVE-2020-4613: Use of a Broken or Risky Cryptographic Algorithm

IBM Data Risk Manager iDNA 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184925...

PT-2020-18160

Name of the Vulnerable Software and Affected Versions IBM Data Risk Manager iDNA version 2.0.6 Description The issue concerns the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For IBM Data Risk Manager...

PT-2020-18161

Name of the Vulnerable Software and Affected Versions IBM Data Risk Manager iDNA version 2.0.6 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt sensitive information. Recommendations For IBM Data Risk Manager iD...

CVE-2020-4614

IBM Data Risk Manager iDNA 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 184927...

CVE-2020-4613

IBM Data Risk Manager iDNA 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184925...

USN-4504-1: OpenSSL vulnerabilities

Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky discovered that certain Diffie-Hellman ciphersuites in the TLS specification and implemented by OpenSSL contained a flaw. A remote attacker could possibly use this issue to eavesdrop on encrypted communications. This was fixed i...

New Linux Malware Steals Call Details from VoIP Softswitch Systems

Cybersecurity researchers have discovered an entirely new kind of Linux malware dubbed "CDRThief" that targets voice over IP VoIP softswitches in an attempt to steal phone call metadata. "The primary goal of the malware is to exfiltrate various private data from a compromised softswitch, includin...

Vulnerability found in BIG-IP

F5 has found a vulnerability in BIG-IP. The vulnerability enables an unauthenticated remote malicious party to opportunity to decrypt TLS-encrypted messages. The malicious party must perform a rogue TLS handshake to do so. BIG-IP categorizes this vulnerability according to the CVSSv3 method with ...

FreeBSD : Mbed TLS -- Local side channel attack on classical CBC decryption in (D)TLS (4c69240f-f02c-11ea-838a-0011d823eebd)

Manuel Pegourie-Gonnard reports : When decrypting/authenticating DTLS record in a connection using a CBC ciphersuite without the Encrypt-then-Mac extension RFC 7366, Mbed TLS used dummy rounds of the compression function associated with the hash used for HMAC in order to hide the length of the...

MGASA-2020-0364 Updated python-rsa packages fix security vulnerability

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

Updated python-rsa packages fix security vulnerability

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

Mbed TLS -- Local side channel attack on classical CBC decryption in (D)TLS

Manuel Pégourié-Gonnard reports: When decrypting/authenticating DTLS record in a connection using a CBC ciphersuite without the Encrypt-then-Mac extension RFC 7366, Mbed TLS used dummy rounds of the compression function associated with the hash used for HMAC in order to hide the length of the...

Security Bulletin: Use of a Broken or Risky Cryptographic Algorithm in Resilient App Host (CVE-2020-4637)

Summary Resilient App Host Beta was using weaker than expected Cryptographic Algorithm. Vulnerability Details CVEID: CVE-2020-4637 DESCRIPTION: IBM Resilient uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base score: 5...

Huawei EulerOS: Security Advisory for python-rsa (EulerOS-SA-2020-1878)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux AMI : python-rsa (ALAS-2020-1421)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1421 advisory. Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses...

IBM Security Guardium Insights Information Disclosure Vulnerability (CNVD-2020-49935)

IBM Security Guardium Insights is a modern hybrid cloud data security hub designed to provide a reliable view of an organization's data security and compliance posture. IBM Security Guardium Insights 2.0.1 suffers from an information disclosure vulnerability that can be exploited by an attacker t...

IBM Security Guardium Insights Information Disclosure Vulnerability (CNVD-2020-49936)

IBM Security Guardium Insights is a modern hybrid cloud data security hub designed to provide a reliable view of an organization's data security and compliance posture. IBM Security Guardium Insights 2.0.1 suffers from an information disclosure vulnerability that can be exploited by an attacker t...

EulerOS 2.0 SP8 : python-rsa (EulerOS-SA-2020-1878)

According to the version of the python-rsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g.,...