1025 matches found
free5GC udm vulnerable to Invalid Curve Attack
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...
GHSA-CQVV-R3G3-26RF free5GC udm vulnerable to Invalid Curve Attack
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...
CVE-2023-46324
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...
Code injection
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...
CVE-2023-46324
CVE-2023-46324 affects free5GC UDM before 1.2.0. The vulnerability in pkg/suci/suci.go arises when using Go
CVE-2023-46324: Improper Verification of Cryptographic Signature
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...
CVE-2023-46324
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...
free5GC Data Forgery Issue Vulnerability
free5GC is an open source project for 5th Generation 5G mobile core networks open sourced by free5GC. A security vulnerability exists in free5GC udm versions prior to 1.2.0, which stems from a problem in pkg/suci/suci.go that allows an invalid curve attack when using Go prior to 1.19. An attacker...
CVE-2023-46324
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...
CVE-2023-4659 Cross-Site Request Forgery in Free5Gc
Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an...
CVE-2023-4659 Cross-Site Request Forgery in Free5Gc
Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an...
free5GC Cross-Site Request Forgery Vulnerability
free5GC is a 5th Generation 5G mobile core network open source project by free5GC open source. free5GC suffers from a cross-site request forgery vulnerability that stems from the presence of a cross-site request forgery CSRF vulnerability. An attacker can exploit this vulnerability to create,...
PT-2023-30105 · Free5Gc · Free5Gc
Name of the Vulnerable Software and Affected Versions: Free5Gc affected versions not specified Description: The issue is related to a Cross-Site Request Forgery vulnerability. This vulnerability could allow an attacker to perform different actions on the platform as an administrator by changing t...
GHSA-M74X-FXJH-3QH9 Free5gc vulnerable to uncontrolled resource consumption
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages...
Free5gc vulnerable to uncontrolled resource consumption
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages...
CVE-2022-38871
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages...
Design/Logic Flaw
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages...
CVE-2022-38871: Uncontrolled Resource Consumption
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages...
CVE-2022-38871
CVE-2022-38871 affects Free5gc v3.0.5, where the AMF can break due to malformed NAS messages. The issue is limited to the AMF component and is described with a high impact on availability (CVE score 7.5, network attack vector, no privileges required). The provided documents consistently describe ...