3676 matches found
When you shouldn’t trust a trusted root certificate
Root certificates are the cornerstone of authentication and security in software and on the Internet. They're issued by a certified authority CA and, essentially, verify that the software/website owner is who they say they are. We have talked about certificates in general before, but a recent eve...
Failed to import Veeam Cloud Connect certificate after Veeam Availability Console server migration
Challenge After migrating your Veeam Availability Console VAC installation to a new server and adding an existing Veeam Cloud Connect VCC server, the following certificate error may be observed: Failed to import certificate from the Veeam Cloud Connect server. See debug logs for more information...
[ASA-201711-14] openssl: multiple issues
Arch Linux Security Advisory ASA-201711-14 ========================================== Severity: Medium Date : 2017-11-07 CVE-ID : CVE-2017-3735 CVE-2017-3736 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-477 Summary ======= The package openssl...
Carry Propagation
OpenSSL is vulnerable to a carry propagation issue with the x8664 Montgomery squaring procedure. This attack can be carried out against unpatched systems using a target private key with persistent DH parameters and a private key which is shared with multiple clients. This could in some...
OpenSSL Information Disclosure Vulnerability (CNVD-2017-35879)
OpenSSL is a Secure Sockets Layer cryptographic library that includes the major cryptographic algorithms, commonly used key and certificate encapsulation management functions, and the SSL protocol, and provides a rich set of applications for testing and other purposes. An information disclosure...
bn_sqrx8x_internal carry bug on x86_64
There is a carry propagating bug in the x8664 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible...
CVE-2017-3736
There is a carry propagating bug in the x8664 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely...
CVE-2017-15610
An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the...
CVE-2017-15610
An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access is enabled for the Octopus Server, an attacker can sign in as the Guest account and export Certificates managed by Octopus, including the...
SSL Certificate Contains Weak RSA Key (Infineon TPM / ROCA)
At least one of the X.509 certificates sent by the remote host has an RSA key that appears to be generated improperly, most likely by a TPM Trusted Platform Module produced by Infineon Technologies. A third party may be able to recover the private key from the certificate's public key. This may...
Infineon RSA library does not properly generate RSA key pairs
Overview The Infineon RSA library version 1.02.013 does not properly generate RSA key pairs, which may allow an attacker to recover the RSA private key corresponding to an RSA public key generated by this library. This vulnerability is often cited as "ROCA" in the media. Description...
Code injection
Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...
CVE-2015-7503
Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...
CVE-2015-7503
CVE-2015-7503 affects Zend Framework and Zend Crypt RSA public-key encryption. Zend Framework 2.x before 2.4.9 and 2.5.x before 2.5.2 used OPENSSL_PKCS1_PADDING (PKCS#1 v1.5) in Zend\Crypt\PublicKey\Rsa::encrypt(), enabling a Bleichenbacher-style attack to recover the RSA private key. Exploitatio...
Chef Information Disclosure Vulnerability
Chef is written by Ruby form management software , it is a pure Ruby domain-specific language DSL to save the system configuration "recipes recipes" or "cookbook cookbooks". chef Developed by Opscode , and released under the Apache protocol version 2.0 open source . A security vulnerability exist...
Red Hat FreeIPA Arbitrary Certificate Issuance Vulnerability
Red Hat FreeIPA is an integrated security information management solution from Red Hat, Inc. The solution provides an easy-to-manage identity, policy and audit IPA suite for Linux and Unix computer networks. A security vulnerability in ipa-kra-install in Red Hat FreeIPA versions prior to 4.2.2...
Trend Micro OfficeScan 11.0/XG (12.0) - Private Key Disclosure
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14083-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-REMOTE-ENCRYPTION-KEY-DISCLOSURE.txt + ISR: ApparitionSec Vendor: ================== www.trendmicro.com Product: ========...
Design/Logic Flaw
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...