xzbot

xzbot Exploración de la puerta trasera de xz CVE-2024-3094. Incluye lo siguiente: honeypot: servidor vulnerable falso para detectar intentos de explotación ed448 patch: parchea liblzma.so para usar nuestra propia clave pública ED448 backdoor format: formato de la carga útil de la puerta trasera...

GHSA-X33G-CR3X-6449 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Summary PyJWT accepts internally inconsistent OKP private JWKs where the declared public key x does not correspond to the supplied private key d. When d is present, OKPAlgorithm.fromjwk constructs the Ed25519/Ed448 private key from d without verifying that the public key derived from d matches x...

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Summary PyJWT accepts internally inconsistent OKP private JWKs where the declared public key x does not correspond to the supplied private key d. When d is present, OKPAlgorithm.fromjwk constructs the Ed25519/Ed448 private key from d without verifying that the public key derived from d matches x...

ALPINE-CVE-2025-15469

Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms such as Ed25519, Ed448, or ML-DSA m...

CVE-2025-15469

Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms such as Ed25519, Ed448, or ML-DSA m...

CVE-2025-15469 'openssl dgst' one-shot codepath silently truncates inputs >16MB

Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms such as Ed25519, Ed448, or ML-DSA m...

Exploit for Embedded Malicious Code in Tukaani Xz

xzbot Exploration of the xz backdoorhttps://www.openwall.c...

PT-2022-37248 · Git +1 · Wolfssl

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a stack-buffer-overflow crash. Technical details include the involvement of specific function names such as wc Shake256 Final, wc...

cryptofuzz:cryptofuzz-boringssl: Stack-buffer-overflow in wc_Shake256_Final

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5623509891547136 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Stack-buffer-overflow WRITE...

wolfssl:cryptofuzz-normal-math: Stack-buffer-overflow in wc_Shake256_Final

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5057208924110848 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-normal-math Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Addres...

openssl security and bug fix update

1.1.1c-15 - add selftest of the RANDDRBG implementation 1.1.1c-14 - fix incorrect error return value from FIPSselftestdsa - S390x: properly restore SIGILL signal handler 1.1.1c-12 - additional fix for the edk2 build 1.1.1c-9 - disallow use of SHA-1 signatures in TLS in FIPS mode 1.1.1c-8 - fix...