CVE-2024-1631 agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`

Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using...

Medium: nss

Issue Overview: Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox 121. CVE-2023-6135 Affected Packages: nss Issue Correction: Run dnf update nss...

Medium: nss

Issue Overview: Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox 121. CVE-2023-6135 Affected Packages: nss Issue Correction: Run dnf update nss...

Medium: nss-softokn

Issue Overview: Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox 121. CVE-2023-6135 Affected Packages: nss-softokn Note: This advisory is applicable...

Amazon Linux 2 : nss-softokn (ALAS-2024-2456)

The version of nss-softokn installed on the remote host is prior to 3.90.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2456 advisory. Multiple NSS NIST curves were susceptible to a side-channel attack known as Minerva. This attack could potentially allow an...

Security Bulletin: IBM Match 360 is vulnerable to Apache Santuario used within IBM WebSphere Application Server Liberty (CVE-2023-44483)

Summary IBM Match 360 is vulnerable to Apache Santuario used within IBM WebSphere Application Server Liberty. Apache Santuario could allow a remote authenticated attacker to obtain sensitive information, caused by the storage of a private key in the log files when using the JSR 105 API. By gainin...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.7 security update on RHEL 9

New Red Hat Single Sign-On 7.6.7 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

nss: vulnerable to Minerva side-channel information leak

The Network Security Services NSS package contains a vulnerability that exposes a side-channel information leak. This weakness enables a local attacker to capture several thousand usages of a signature, allowing them to utilize this information to recover portions of an ECDSA private key...

nss: vulnerable to Minerva side-channel information leak

The Network Security Services NSS package contains a vulnerability that exposes a side-channel information leak. This weakness enables a local attacker to capture several thousand usages of a signature, allowing them to utilize this information to recover portions of an ECDSA private key...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.0 for Quarkus 3.2 release (RHBQ 3.2.10.Final)

An update for Red Hat Build of Apache Camel 4.0 for Quarkus 3.2 is now available updates to RHBQ 3.2.10.Final. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

nss: vulnerable to Minerva side-channel information leak

The Network Security Services NSS package contains a vulnerability that exposes a side-channel information leak. This weakness enables a local attacker to capture several thousand usages of a signature, allowing them to utilize this information to recover portions of an ECDSA private key...

RHEL 8 : nss (RHSA-2024:0786)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0786 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

RHEL 9 : nss (RHSA-2024:0790)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0790 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

RHEL 8 : nss (RHSA-2024:0785)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0785 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

UBUNTU-CVE-2023-6935

wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to configure: --enable-all CFLAGS="-DWOLFSSLSTATICRSA" The define “WOLFSSLSTATICRSA” enables static RSA cipher suites, which is n...

Security Bulletin: IBM PowerVM Novalink is vulnerable because Apache Santuario could allow a remote authenticated attacker to obtain sensitive information, caused by the storage of a private key in the log files.(CVE-2023-44483)

Summary IBM PowerVM Novalink is vulnerable because Apache Santuario could allow a remote authenticated attacker to obtain sensitive information, caused by the storage of a private key in the log files when using the JSR 105 API. By gaining access to the log files, an attacker could exploit this...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...