The vulnerability of the Git-based software platform for collaborative code development on GitLab allows a hacker to circumvent security restrictions.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to shortcomings in the authentication process when managing keys and tokens using deployment scripts. Exploiting this vulnerability allows a malicious actor to circumvent security...

Design/Logic Flaw

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service KMS defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the...

CVE-2023-0690 Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service KMS defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the...

CVE-2023-0690 Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service KMS defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the...

CVE-2023-0690

HashiCorp Boundary is affected from 0.10.0 through 0.11.2 when using a PKI-based worker with a KMS defined in the config. New credentials created after automatic rotation may not have been encrypted by the intended KMS, resulting in plaintext on the Boundary PKI worker’s disk. The issue is fixed ...

Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured

Summary A vulnerability in Boundary was identified such that when a Key Management Service KMS was defined in Boundary’s configuration file with the intent of using the KMS to encrypt the credentials stored on disk, new credentials created after an automatic rotation may not have been encrypted v...

PT-2023-16458 · Hashicorp · Hashicorp Boundary

Name of the Vulnerable Software and Affected Versions: HashiCorp Boundary versions 0.10.0 through 0.11.2 Description: The issue arises when using a PKI-based worker with a Key Management Service KMS defined in the configuration file. After an automatic rotation, new credentials may not be encrypt...

The vulnerability of the FortiOS operating systems, related to errors in managing the RSA SSH cryptographic key, allows a perpetrator to perform a “man-in-the-middle” attack.

The vulnerability of the FortiOS operating systems is related to errors in the management of the RSA SSH cryptographic key. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack...

kernel: kernel info leak issue in pfkey_register

A vulnerability was found in the pfkeyregister function in net/key/afkey.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information...

Fortinet Fortigate RSA SSH host key lost at shutdown (FG-IR-22-228)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-228 advisory. - A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below,...

CVE-2022-30307

A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack...

Design/Logic Flaw

A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack...

CVE-2022-30307

A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack...

CVE-2022-30307

CVE-2022-30307 affects FortiOS RSA SSH host key handling. Affected versions: FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below. Root cause is a key management error (CWE-320) that may enable an unauthenticated attacker to perform a Man-in-the-Middle (MITM) attack by abusing the RSA SSH ho...

CVE-2022-30307: Undefined Security Weakness

A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack...

CVE-2022-30307

A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack...

RSA SSH host key lost at shutdown

...

SUSE-SU-2022:3800-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 102.4.0 bsc1204421 changed: Thunderbird will automatically detect and repair OpenPGP key storage corruption caused by using the profile import tool in Thunderbird 102 fixed: POP message download into a large fold...

USN-5697-1: Barbican vulnerability

Douglas Mendizabal discovered that Barbican incorrectly handled certain query strings. A remote attacker could possibly use this issue to bypass the access policy...

age and Authenticated Encryption

age is a file encryption format, tool, and library. It was made to replace one of the last remaining GnuPG use cases, but it was not made to replace GnuPG because in the last 20 years we learned that cryptographic tools work best when they are specialized and opinionated instead of flexible Swiss...