4497 matches found
Mandrake Linux Security Advisory : gnupg (MDKSA-2001:045)
GnuPG version 1.0.5 has been released that fixes a few security problems, including a vulnerability that makes it easier for an attacker to recover your private key if they are able to steal your keyring. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks...
Mandrake Linux Security Advisory : gnupg (MDKSA-2003:109)
A severe vulnerability was discovered in GnuPG by Phong Nguyen relating to ElGamal sign+encrypt keys. From Werner Koch's email message : 'Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a...
Fedora Core 1 : gnupg-1.2.3-2 (2003-025)
Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys, when those keys are used both to sign and encrypt data. This vulnerability can be used to trivially recover the private key. While the default behavior of GnuPG when generating keys does not lead to the creation ...
RHEL 2.1 / 3 : gnupg (RHSA-2003:395)
Updated gnupg packages are now available for Red Hat Enterprise Linux. These updates disable the ability to generate ElGamal keys used for both signing and encrypting and disable the ability to use ElGamal public keys for encrypting data. GnuPG is a utility for encrypting data and creating digita...
SSH Tectia Server contains a race condition when the password change plugin is enabled
Overview SSH Tectia Server contains a race condition that may permit an authenticated user access to the private key of the server. Exploitation of this vulnerability may lead to the ability to compromise the trust relationships of the vulnerable server. Description SSH Tectia Server versions 4.0...
CVE-2004-0350
SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factoring...
CVE-2004-0351
Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data...
CVE-2004-0350
The CVE-2004-0350 entry affects the SpiderSales shopping cart, which does not enforce a minimum length for the private key. This weakens key material quality and can let local users obtain the private key by factoring, with an in‑the‑wild risk limited by local access and a low base score (2.1). T...
CVE-2004-0351
The CVE-2004-0351 issue concerns Spider Sales shopping cart, where the private key is stored in the same database/table as the public key. This design enables local users with database access to decrypt data, affecting confidentiality (partial). The available sources describe the vulnerable behav...
CVE-2004-0350: Undefined Security Weakness
SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factoring...
CVE-2004-0351: Undefined Security Weakness
Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data...
CVE-2003-1120
Race condition in SSH Tectia Server 4.0.3 and 4.0.4 for Unix, when the password change plugin ssh-passwd-plugin is enabled, allows local users to obtain the server's private key...
GnuPG creates ElGamal keys for signing using insufficient entropy
Overview Gnu Privacy Guard GnuPG is a cryptographic utility used to generate cryptographic keys and perform other cryptographic functions. A vulnerability in the way GnuPG generates ElGamal keys has been discovered. This vulnerability renders ElGamal signing key untrustworthy. Description A...
CVE-2003-0971
GnuPG GPG 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 sign+encrypt keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature...
Important: Red Hat Security Advisory: : Updated gnupg packages disable ElGamal keys
Updated gnupg packages are now available for Red Hat Linux. These updates disable the ability to generate ElGamal keys used for both signing and encrypting and disable the ability to use ElGamal public keys for encrypting data. GnuPG is a utility for encrypting data and creating digital signature...
security flaw
GnuPG GPG 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 sign+encrypt keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature...
CVE-2003-0971
GnuPG GPG 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 sign+encrypt keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature...
CVE-2003-0971
GnuPG (GPG) versions 1.0.2 through 1.2.3 are affected by an ElGamal sign+encrypt issue where the same key component is used for encryption and signing. The root cause is the construction of ElGamal type 20 keys, which allows an attacker to determine the private key from a signature. The connected...
CVE-2003-0971: Undefined Security Weakness
GnuPG GPG 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 sign+encrypt keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature...
