GHSA-V4MM-Q8FV-R2W5 WildFly Elytron: SSRF security issue

A flaw was found in JwtValidator.resolvePublicKey in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery SSRF vulnerabili...

CVE-2024-1233 Eap: wildfly-elytron has a ssrf security issue

A flaw was found in JwtValidator.resolvePublicKey in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery SSRF vulnerabili...

Red Hat JBoss Enterprise Application Platform 安全漏洞

Red Hat JBoss Enterprise Application Platform EAP is an open source, J2EE-based middleware platform from Red Hat, Inc. The platform is primarily used to build, deploy and host Java applications and services. A security vulnerability exists in Red Hat JBoss Enterprise Application Platform, which...

opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key...

CVE-2023-28547

Memory corruption in SPS Application while requesting for public key in sorter TA...

CVE-2023-28547

CVE-2023-28547 is a memory corruption issue in the SPS Application when requesting a public key in the sorter Trust Agent (TA), affecting Qualcomm components (including closed-source parts). Root cause described as memory corruption in SPS Application; exposed impact on confidentiality, integrity...

CVE-2023-28547 Buffer Copy Without Checking Size of Input in SPS Applications

Memory corruption in SPS Application while requesting for public key in sorter TA...

CVE-2023-28547 Buffer Copy Without Checking Size of Input in SPS Applications

Memory corruption in SPS Application while requesting for public key in sorter TA...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from a memory corruption in the SPS application when requesting a public key in the classifier TA...

PT-2024-12171 · Unknown · Sps Application

Name of the Vulnerable Software and Affected Versions: SPS Application affected versions not specified Description: The issue concerns memory corruption in the SPS Application when requesting a public key in the sorter TA. Recommendations: At the moment, there is no information about a newer...

CVE-2023-33855

Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture CCA 7.0.0 through 7.5.36 may exhibit non-constant-time behavior. This could allow a remote attacker to obtain sensitive information using a timing-based attack. IBM X-Force ID: 257676...

Denial Of Service

go is vulnerable to Denial Of Service. The vulnerability is due to insufficient handling of certificate chains containing certificates with unknown public key algorithms...

BIT-GOLANG-2024-24783 Verify panics on certificates with an unknown public key algorithm in crypto/x509

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...

CVE-2024-28122

An uncontrolled resource consumption vulnerability was found in jwx. This flaw allows an attacker with a trusted public key to cause a denial of service condition by crafting a malicious JWE token with an exceptionally high compression ratio...

JWX Security Vulnerabilities

lestrrat-go jwx is a library for lestrrat-go individual developers. A security vulnerability exists in JWX versions 1.2.29 and prior to 2.0.21, which originated from a vulnerability that allows an attacker in possession of a trusted public key to cause a denial of service by crafting malicious JS...

GHSA-HJ3V-M684-V259 JWX vulnerable to a denial of service attack using compressed JWE message

Summary This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory...

Fedora: Security Advisory for dogtag-pki (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: dogtag-pki-11.5.0-3.fc40

Dogtag PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. Dogtag PKI consists of the following components: Certificate Authority CA Key Recovery Authority KRA Online Certificate Status Protocol OCSP Manager Token Key Service TKS Token...

opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key...

SUSE-SU-2024:0800-1 Security update for go1.21

This update for go1.21 fixes the following issues: - Upgrade go to version 1.21.8 - CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect bsc1221000 - CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm bsc122100...