GHSA-G753-JX37-7XWH ECDSA signature vulnerability of Minerva timing attack in jsrsasign

Impact ECDSA side-channel attack named Minerava have been found and it was found that it affects to jsrsasign. Execution time of thousands signature generation have been observed then EC private key which is scalar value may be recovered since point and scalar multiplication time depends on bits ...

CVE-2020-11735

The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."...

CVE-2020-11735

The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."...

DEBIAN-CVE-2020-11735

The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."...

CVE-2020-11735

The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."...

Design/Logic Flaw

The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."...

UBUNTU-CVE-2020-11735

The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."...

CVE-2020-11735

The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."...

CVE-2020-11735

The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak."...

CVE-2020-12053

In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a private key...

CVE-2020-12053

In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a private key...

CVE-2020-12053

In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a private key...

GaussDB: Restricting the Permission for the SSL Private Key

If SSL is used, you need to configure the SSL certificate on the database server. You are advised to set the permission for the private key file to owner-readable-only. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright...

CVE-2020-12402

A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality...

Schneider Electric Easergy T300 Information Disclosure Vulnerability (CNVD-2021-21478)

The Schneider Electric Easergy T300 is a remote terminal unit for the power industry from Schneider Electric, France. An information disclosure vulnerability exists in the Schneider Electric Easergy T300 using firmware version 1.5.2 and earlier, which can be exploited by an attacker to obtain a...

EulerOS 2.0 SP2 : openssl (EulerOS-SA-2020-1625)

According to the version of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected...

MGASA-2020-0265 Updated mbedtls packages fix security vulnerability

Updated mbedtls packages fix security vulnerability Fix side channel in ECC code that allowed an adversary with access to precise enough timing and memory access information typically an untrusted operating system attacking a secure enclave to fully recover an ECDSA private key. CVE-2020-10932 Fi...

The vulnerability of the implementation of TLS and SSL software from Mbed TLS arises from the lack of encryption measures for protected data. This allows attackers to compromise the RSA private key.

The vulnerability of the implementation of TLS and SSL software developed by Mbed TLS is related to the failure to encrypt protected data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain the RSA secret key...

Datapower Settings

This plugin just sets global variables for datapower TRUSTED...

[ASA-202006-4] thunderbird: multiple issues

Arch Linux Security Advisory ASA-202006-4 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-12398 CVE-2020-12399 CVE-2020-12405 CVE-2020-12406 CVE-2020-12410 Package : thunderbird Type : multiple issues Remote : Yes Link :...