USN-3850-2: NSS vulnerabilities

USN-3850-1 fixed several vulnerabilities in NSS. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack...

The vulnerability of the _gcry_ecc_ecdsa_sign function in the Libgcrypt cryptographic library allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the gcryeccecdsasign function “cipher/ecc-ecdsa.c” in the cryptographic library Libgcrypt relates to the possibility of determining plausible values for basic parameters of a next digital signature by iterating through cache values and evaluating computational costs. This cou...

Security Bulletin: IBM Systems Director is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL Vulnerability Details Abstract IBM Systems Director is affected by vulnerabilities in OpenSSL CVE-2014-0160 and CVE-2014-0076. Content Vulnerability Details: CVE-ID: CVE-2014-0160 Description: OpenSSL could allow a remote attacker t...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software

Summary Multiple Node.js vulnerabilities were disclosed by the Node.js project. Node.js is used by the Cordova tools in IBM Rational Application Developer for WebSphere Software. IBM Rational Application Developer for WebSphere Software has addressed the applicable CVEs. Vulnerability Details...

Denial Of Service (DoS)

crypto/elliptic in github.com/golang/go is vulnerable to denial of service DoS. The attack exists because it introduces a long busy loop in subtraction term for the implementation of P-521 and P-384 elliptic curve cryptography algorithms which allows malicious input through TLS handshakes, X.509...

OpenSSL 1.1.1 < 1.1.1a Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.1.1a. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1a advisory. - The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use...

OpenSSL 1.1.0 < 1.1.0j Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.1.0j. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.0j advisory. - The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use...

[ASA-201901-10] go-pie: private key recovery

Arch Linux Security Advisory ASA-201901-10 ========================================== Severity: Medium Date : 2019-01-24 CVE-ID : CVE-2019-6486 Package : go-pie Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-859 Summary ======= The package go-pie before version...

Fedora 29 : openssh (2019-f6ff819834)

This update fixes CVE-2018-20685 the first 'variant' and backports several fixes to unbreak ECDSA authentication from PKCS11, certificate authentication and so on. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

MGASA-2019-0038 Updated nss packages fix security vulnerability

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys CVE-2018-0495...

Updated nss packages fix security vulnerability

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys CVE-2018-0495...

Spoofable ECDSA Signatures

nss-softokn is vulnerable to spoofable ECDSA signatures. The vulnerability exists as Mozilla Network Security Services NSS before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve...

Ubuntu: Security Advisory (USN-3850-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : NSS vulnerabilities (USN-3850-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3850-1 advisory. Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perfo...

USN-3850-1: NSS vulnerabilities

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys. CVE-2018-0495 It was discovered that NSS incorrectly handled certain v2-compatible ClientHello messages. A remo...

Fedora 28 : botan2 (2018-eaa7de17ae)

Update Botan2 to 2.7.0. Focus of this release is on performance and side channel hardening. - Address side channels in RSA key generation and ECDSA signing - Side channel hardening in many core algorithms modular exponentiation, ECC scalar multiply, Karatsuba multiplication, Barrett reduction, et...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2018:2036-1)

This update for openssl-11 fixes the following issues : - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating ...

SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2018:1993-1)

This update for libgcrypt fixes the following issue: The following security issue was fixed : - CVE-2018-0495: Fixed a novel side-channel attack, by enabling blinding for ECDSA signatures bsc1097410 Note that Tenable Network Security has extracted the preceding description block directly from the...

SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2018:2812-1)

This update for nodejs8 to version 8.11.4 fixes the following issues : Security issues fixed : CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be used to write to memory outside of a Buffer's memory space buffer bsc1105019 Upgrade to OpenSSL 1.0.2p, which fixed : -...

SUSE SLES15 Security Update : openssl-1_1 (SUSE-SU-2018:2041-1)

This update for openssl-11 fixes the following issues : - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating ...