1221 matches found
Auth tag forgery vulnerability with AES-GCM encrypted JWT
Ruby's OpenSSL bindings do not check the length of the supplied authentication tag when decrypting an authenticated encryption mode such as AES-GCM, leaving this up to the authors of a gem/app to implement for properly validating the message. json-jwt was not checking for the authentication tag...
SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2018:0665-1)
This update for java-180-ibm fixes the following issues : - Removed java-180-ibm-alsa and java-180-ibm-plugin entries in baselibs.conf due to errors in osc sourcevalidator Version update to 8.0.5.10 bsc1082810 - Security fixes: CVE-2018-2639 CVE-2018-2638 CVE-2018-2633 CVE-2018-2637 CVE-2018-2634...
Ninja Shell - Port Knocking Technique With AES256-GCM
Raw socket shell with AES256-GCM, using Port Knocking technique https://en.wikipedia.org/wiki/Portknocking using specific tcp flags ,FIN,URG and PSH. Raw socket ? Raw mode is basically there to allow you to bypass some of the way that your computer handles TCP/IP. Rather than going through the...
GHSA-6H88-QJPV-P32M OpenSSL gem for Ruby using inadequate encryption strength
The OpenSSL gem for Ruby uses the same initialization vector IV in GCM Mode aes--gcm when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism...
OpenSSL gem for Ruby using inadequate encryption strength
The OpenSSL gem for Ruby uses the same initialization vector IV in GCM Mode aes--gcm when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism...
Incorrect handling of initialization vector in the GCM mode in OpenSSL
The openssl gem for Ruby uses the same initialization vector IV in GCM Mode aes--gcm when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism...
CVE-2017-7822
The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specification. This might allow for the authentication key to be determined in some instances. This vulnerability affects Firefox 56...
Security vulnerabilities fixed in Firefox 56 — Mozilla
A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake addre...
bouncycastle: Information disclosure in GCMBlockCipher
It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information...
bouncycastle: Information disclosure in GCMBlockCipher
It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information...
bouncycastle: Information disclosure in GCMBlockCipher
It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information...
Playing with kernel TLS in Linux 4.13 and Go
Linux 4.13 introduces support for nothing less than... TLS! The 1600 LoC patch allows userspace to pass the kernel the encryption keys for an established connection, making encryption happen transparently inside the kernel. The only ciphersuite supported is AES-128-GCM as per RFC 5288, meaning it...
Playing with kernel TLS in Linux 4.13 and Go
Linux 4.13 introduces support for nothing less than... TLS! The 1600 LoC patch allows userspace to pass the kernel the encryption keys for an established connection, making encryption happen transparently inside the kernel. The only ciphersuite supported is AES-128-GCM as per RFC 5288, meaning it...
Debian DSA-3966-1 : ruby2.3 - security update
Multiple vulnerabilities were discovered in the interpreter for the Ruby language : - CVE-2015-9096 SMTP command injection in Net::SMTP. - CVE-2016-7798 Incorrect handling of initialization vector in the GCM mode in the OpenSSL extension. - CVE-2017-0900 Denial of service in the RubyGems client. ...
[SECURITY] [DSA 3966-1] ruby2.3 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3966-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 05, 2017 https://www.debian.org/security/faq -...
Debian: Security Advisory (DSA-3966-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux AMI : ruby23 (ALAS-2017-880)
IV Reuse in GCM Mode : The openssl gem for Ruby uses the same initialization vector IV in GCM Mode aes--gcm when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism. CVE-2016-7798 C Tenable Network Security, Inc. The...
Medium: ruby23
Issue Overview: IV Reuse in GCM Mode: The openssl gem for Ruby uses the same initialization vector IV in GCM Mode aes--gcm when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism. CVE-2016-7798 Affected Packages: ruby2...
bouncycastle: Information disclosure in GCMBlockCipher
It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information...
BadIntent - Intercept, Modify, Repeat and Attack Android's Binder Transactions Using Burp Suite
BadIntent is the missing link between the Burp Suite and the core Android's IPC/Messaging-system. BadIntent consists of two parts, an Xposed-based module running on Android and a Burp-plugin. Based on this interplay, it is possible to use the Burp's common workflow and all involved tools and...