TLS Version 1.1 Deprecated Protocol

The remote service accepts connections encrypted using TLS 1.1. TLS 1.1 lacks support for current and recommended cipher suites. Ciphers that support encryption before MAC computation, and authenticated encryption modes such as GCM cannot be used with TLS 1.1 As of March 31, 2020, Endpoints that...

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.

...

CVE-2021-3744

A memory leak flaw was found in the Linux kernel in the ccprunaesgcmcmd function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service memory consumption. This vulnerability is similar with the older CVE-2019-18808...

DEBIAN-CVE-2021-3744

A memory leak flaw was found in the Linux kernel in the ccprunaesgcmcmd function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service memory consumption. This vulnerability is similar with the older CVE-2019-18808...

CVE-2021-3744

A memory leak flaw was found in the Linux kernel in the ccprunaesgcmcmd function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service memory consumption. This vulnerability is similar with the older CVE-2019-18808...

Memory corruption

A memory leak flaw was found in the Linux kernel in the ccprunaesgcmcmd function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service memory consumption. This vulnerability is similar with the older CVE-2019-18808...

CVE-2021-3744

A memory leak flaw was found in the Linux kernel in the ccprunaesgcmcmd function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service memory consumption. This vulnerability is similar with the older CVE-2019-18808...

Samsung Encryption Flaw

Researchers have found a major encryption flaw in 100 million Samsung Galaxy phones. From the abstract: In this work, we expose the cryptographic design and implementation of Androids Hardware-Backed Keystore in Samsungs Galaxy S8, S9, S10, S20, and S21 flagship devices. We reversed-engineered an...

Insecure Cryptography

github.com/aws/aws-sdk-go is vulnerable to insecure cryptography. The vulnerability exists due to broken encryption algorithm which allows an attacker with write access to change AES-GCM to AES-CTR...

GHSA-7F33-F4F5-XWGW In-band key negotiation issue in AWS S3 Crypto SDK for golang

Summary The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures without revealing the plaintext...

Use of a Broken or Risky Cryptographic Algorithm

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

Mageia: Security Advisory (MGASA-2014-0315)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: A Remote Attack Vulnerability in Apache Log4j affects Engineering Lifecycle Management and IBM Engineering products

Summary There is a high risk Remote Attack Vulnerability in Apache Log4j CVE-2021-44228 which is used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Workflow Management EWM, IBM Engineering Systems...

PT-2022-6957

Name of the Vulnerable Software and Affected Versions golang.org/x/crypto/ssh package versions prior to 0.0.0-20211202192323-5770296d904e Description The issue is related to insufficient input validation in the golang.org/x/crypto/ssh package, which can be exploited by a remote attacker to cause ...

Security Bulletin: WebSphere Application Server is vulnerable to a denial of service which can impact IBM Engineering Lifecycle Management (ELM) products based on IBM Jazz technology

Summary WebSphere Application Server is vulnerable to a denial of service CVE-2021-38951. This may affect IBM Engineering Products based on IBM Jazz technology. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc

...

wolfssl:cryptofuzz-openssl-api: Heap-buffer-overflow in AesGcmCryptUpdate_C

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4934317875265536 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-api Job Type: libfuzzerasani386wolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 16 Crash...

ASB-A-200041882

In update of kmcompat.cpp, there is a possible loss of potentially sensitive data due to a logic error in the code. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2021-9564)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9564 advisory. - LTS tag: v5.4.142 Jack Vogel CVE-2021-3653 CVE-2021-3656 - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested CVE-2021-3656 Maxim Levitsky -...

EXOCET - AV-evading, Undetectable, Payload Delivery Tool

EXOCET is superior to Metasploit's "Evasive Payloads" modules as EXOCET uses AES-256 in GCM Mode Galois/Counter Mode. Metasploit's Evasion Payloads uses a easy to detect RC4 encryption. While RC4 can decrypt faster, AES-256 is much more difficult to ascertain the intent of the malware. However, i...