MAL-2024-10613 Malicious code in coibnase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ed70ea7684fa79c6219e6176b180a30672bd43e3309a48fc369480adbe64db3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10615 Malicious code in cryptocmopare (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39a4a772e0bb03f5192ee69c42db63db859ee0e831d599f762dcf272c9c8e581 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10617 Malicious code in ethers-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b52650e58d88e598b736b50375a5b7be334cd6d8581a470d2c70624a1bbecbf9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in solana-web3-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcf9d5b7aec80f6f8909d8b65170940ecf00b096f922f111da7848b86257088c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10627 Malicious code in web3-helpers.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b4f43eb01c69ebcb1293d0134dc7fa64f02d938354439483848597057842229 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10622 Malicious code in solana-web3-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcf9d5b7aec80f6f8909d8b65170940ecf00b096f922f111da7848b86257088c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10618 Malicious code in launchpad-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b1c1a2444b5a8db795db02aedebf9d8feddb28e3bc8cafcf438c5d8a086f315 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10626 Malicious code in web3-bundle-helpers.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68813bb35808cbd5a214c8d01a2243e1d1e80df5cd37d11413bbedd08ffd9e44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Low: Red Hat Security Advisory: openssl and openssl-fips-provider security update

An update for openssl and openssl-fips-provider is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openssl: Excessive time spent checking DSA keys and parameters

A flaw was found in OpenSSL. Applications that use the EVPPKEYparamcheck or EVPPKEYpubliccheck function to check a DSA public key or DSA parameters may experience long delays when checking excessively long DSA keys or parameters. In applications that allow untrusted sources to provide the key or...

openssl: Excessive time spent checking invalid RSA public keys

A flaw was found in OpenSSL. When the EVPPKEYpubliccheck function is called in RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is a large...

kernel: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS

A vulnerability has been identified in the Linux kernel's Berkeley Packet Filter BPF subsystem. The flaw resides within the handling of PTRTOFLOWKEYS pointer to flow keys in the checkflowkeysaccess function. Specifically, while fixed offsets are validated for PTRTOFLOWKEYS, the system currently...

kernel: keys: Fix overwrite of key expiration on instantiation

In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for DNS resolution as the expiration set ...

kernel: Input: gpio-keys - cancel delayed work only in case of GPIO

In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys - cancel delayed work only in case of GPIO gpiokeys module can either accept gpios or interrupts. The module initializes delayed work in case of gpios only and is only used if debounce timer is not used, so make...

python-pymysql: SQL injection if used with untrusted JSON input

A flaw was found in PyMySQL. When processing untrusted JSON input, keys are not escaped by the escapedict function due to insufficient input sanitization, allowing an attacker to inject malicious SQL queries...

Checking excessively long DSA keys or parameters may be very slow

OpenSSL contains an unbounded computation flaw when performing checks on excessively large DSA keys or parameters, which could lead to a denial-of-service DoS attack. The OpenSSL pkey, pkeyparam command line apps, and FIPS providers are affected...

ALSA-2024:9333 Low: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: Unbounded memory growth with session handling in TLSv1.3 CVE-2024-2511 openssl: Excessive time...

VulnCheck KEV: CVE-2024-9465

Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the...

Low: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: Unbounded memory growth with session handling in TLSv1.3 CVE-2024-2511 openssl: Excessive time...

OpenSSL is vulnerable to a denial of service, caused by a flaw in the handling of RSA public keys by the EVP_PKEY_public_check() function

OpenSSL is vulnerable to a denial-of-service DoS issue due to how there is no restriction on RSA public key size, or the subsequent time spent processing such keys. Applications that use the EVPPKEYpubliccheck function to check RSA public keys obtained from potentially untrusted sources can be...