GO-2020-0010 Elliptic curve key disclosure in github.com/square/go-jose

When using ECDH-ES an attacker can mount an invalid curve attack during decryption as the supplied public key is not checked to be on the same curve as the receivers private key...

Use of a Broken or Risky Cryptographic Algorithm

Overview elliptic before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

Elliptic Uses a Broken or Risky Cryptographic Algorithm

The npm package elliptic before version 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential...

Information Disclosure

elliptic is vulnerable to information disclosure. Usage of an insecure secp256k1 implementation in elliptic/ec/key.js can cause the disclosure of the private key after a number of ECDH operations are performed...

CVE-2020-28498

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

Code injection

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

CVE-2020-28498

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

CVE-2020-28498 Cryptographic Issues

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

CVE-2020-28498

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

CVE-2020-28498

CVE-2020-28498 affects the elliptic JS library (Node.js elliptic module) specifically the secp256k1 implementation in elliptic/ec/key.js. The root cause is that there is no validation to ensure the public key point passed to derive() actually lies on the secp256k1 curve, enabling potential privat...

CVE-2020-28498: Use of a Broken or Risky Cryptographic Algorithm

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

openSUSE Security Update : openssl-1_0_0 (openSUSE-2020-2269)

This update for openssl-100 fixes the following issues : - CVE-2020-1971: Fixed a NULL pointer dereference in EDIPARTYNAME bsc1179491. - Initialized dh-nid to NIDundef in DHnewmethod bsc1177673. - Fixed a test failure in apachessl in fips mode bsc1177793. - Renamed BNgetrfc3526prime functions bac...

SUSE SLES15 Security Update : stunnel (SUSE-SU-2021:0194-1)

This update for stunnel fixes the following issues : Security issue fixed : The 'redirect' option was fixed to properly handle 'verifyChain = yes' bsc1177580. Non-security issues fixed : Fix startup problem of the stunnel daemon bsc1178533 update to 5.57 : - Security bugfixes - New features - New...

New Year, New Ransomware: Babuk Locker Targets Large Corporations

Only a few days into the new year, one of the first new ransomware strains of 2021 has been discovered. Dubbed Babuk Locker, the ransomware appears to have successfully compromised five companies thus far, according to new research. The research author, Chuong Dong, a computer science student at...

Updated compat-openssl10 packages fix security vulnerabilities

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman DH based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted...

SUSE SLED15 / SLES15 Security Update : wpa_supplicant (SUSE-SU-2020:3380-1) (KRACK)

This update for wpasupplicant fixes the following issues : Security issue fixed : CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass bsc1150934. Non-security issues fixed : Enable SAE support jscSLE-14992. Limit P2PDEVICE name to appropriate ifname size. Fix wicked wlan bsc11569...

openSUSE Security Update : wpa_supplicant (openSUSE-2020-2053) (KRACK)

This update for wpasupplicant fixes the following issues : Security issue fixed : - CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass bsc1150934. Non-security issues fixed : - Enable SAE support jscSLE-14992. - Limit P2PDEVICE name to appropriate ifname size. - Fix wicked wlan...

openSUSE Security Update : wpa_supplicant (openSUSE-2020-2059) (KRACK)

This update for wpasupplicant fixes the following issues : Security issue fixed : - CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass bsc1150934. Non-security issues fixed : - Enable SAE support jscSLE-14992. - Limit P2PDEVICE name to appropriate ifname size. - Fix wicked wlan...

CVE-2020-1968

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman DH based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted...

Raccoon attack

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman DH based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted...