CVE-2023-49292

CVE-2023-49292 affects the Go library github.com/ecies/go (sec p256k1) prior to v2.0.8. A bug in ECDH/point validation allows an attacker to recover a private key interacted with by exploiting an invalid curve point, leading to private key exposure. The issue has been patched in v2.0.8. Affected ...

CVE-2023-49292 Possible private key restoration in go package github.com/ecies/go

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate, Decapsulate and ECDH could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade...

CVE-2023-49292 Possible private key restoration in go package github.com/ecies/go

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate, Decapsulate and ECDH could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade...

OESA-2023-1830 mariadb security update

MariaDB turns data into structured information in a wide array of applications, ranging from banking to websites. It is an enhanced, drop-in replacement for MySQL. MariaDB is used because it is fast, scalable and robust, with a rich ecosystem of storage engines, plugins and many other tools make ...

Rockwell Automation Stratix OpenSSL Elliptic Curve d2i_ECPrivateKey Denial of Service (CVE-2015-0209)

Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or corrupt portions of OpenSSL process memory. This plugin only works with Tenable.ot. Pleas...

Enough Polynomials and Linear Algebra to Implement Kyber

I was once talking with a mathematician and trying to explain elliptic curve cryptography. Eventually, something clicked and they went "oh, that! I think there was a chapter about it in the book. You made a whole field out of it?" Yes, in cryptography we end up focusing on a very narrow slice of...

Rocky Linux 8 : gnutls and nettle (RLSA-2021:1206)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1206 advisory. - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve...

Rocky Linux 8 : compat-openssl10 (RLSA-2022:5326)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5326 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function i...

Rocky Linux 8 : go-toolset:rhel8 (RLSA-2022:5337)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5337 advisory. - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. CVE-2022-24675 - regexp.Compile ...

The vulnerability of the EC key verification library in the Math cryptographic security module of Bouncy Castle allows a perpetrator to gain unauthorized access to the protected information.

The vulnerability of the EC key verification library in the Bouncy Castle cryptographic security framework is related to synchronization errors that occur when using a shared resource for processing deterministic digital signatures of the ECDSA type. Exploiting this vulnerability could allow an...

CVE-2023-3112

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges...

CVE-2023-3112

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges...

Security feature bypass

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges...

Lenovo ThinkPad T14 Gen 3 Security Vulnerability

Lenovo ThinkPad is a portable computer from Lenovo, a Chinese company. A security vulnerability exists in the Lenovo ThinkPad T14 Gen 3, which stems from Elliptic Labs Virtual Lock Sensor allows an attacker with local access rights to execute code with elevated privileges...

CVE-2023-3112

CVE-2023-3112 concerns the Elliptic Labs Virtual Lock Sensor used by ThinkPad T14 Gen 3. Documents confirm a local attacker could execute code with elevated privileges via this sensor. The vulnerability affects the sensor component embedded in ThinkPad laptops, with no public details on affected ...

CVE-2023-3112

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges...

CVE-2023-3112

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges...

Why We Don’t Generate Elliptic Curves Every Day

With all the talk recently of how the NIST curve parameters were selected, a reasonable observer could wonder why we all use the same curves instead of generating them along with keys, like we do for Diffie-Hellman parameters. You might have memories of waiting around for openssl dhparam to run a...

PT-2023-23161 · Elliptic · Elliptic Labs Virtual Lock Sensor

Name of the Vulnerable Software and Affected Versions: Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 affected versions not specified Description: A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to...

Bounty to Recover NIST’s Elliptic Curve Seeds

This is a fun challenge: The NIST elliptic curves that power much of modern cryptography were generated in the late 90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry...