CVE-2020-12402: Observable Discrepancy

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secr...

USN-4417-1 nss vulnerability

Cesar Pereida, Billy Bob Brumley, Yuval Yarom, and Nicola Tuveri discovered that NSS incorrectly handled RSA key generation. A local attacker could possibly use this issue to perform a timing attack and recover RSA keys...

MGASA-2020-0274 Updated firefox packages fix security vulnerability

Updated nss and firefox packages fix security vulnerabilities: NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys CVE-2020-12399. Side channel vulnerabilities during RSA key generation in NSS CVE-2020-12402. When browsing ...

SUSE-SU-2020:1839-1 Security update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr, mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032. - CVE-2020-12399: Fixed a timing attack on DSA signature generation bsc1171978. -...

Security Vulnerabilities fixed in Firefox 78 — Mozilla

When %2F was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. A VideoStreamEncoder may have been freed in a race...

UBUNTU-CVE-2020-12402

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secr...

CVE-2020-12402

A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality...

PT-2020-4102

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 78 Description: The issue is related to weaknesses in the cryptographic algorithms used by the Network Security Services NSS library. It allows an attacker to gain access to confidential data by exploiting a side...

Security advisory YSA-2020-02, YSA-2020-03 | Yubico | YubiKey

The libykpiv library, included in the Yubico PIV Tool project and the YubiKey Smart Card Minidriver, does not properly check embedded length fields during device communication. A maliciously-crafted PIV token could possibly misreport the returned length fields during RSA key generation. This coul...

Huawei EulerOS: Security Advisory for openssl110f (EulerOS-SA-2018-1214)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Vulnerabilities CVE-2018-0732 and CVE-2018-0737 in OpenSSL affect IBM i

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server during key agreement in a TLS...

CVE-2013-2228

SaltStack RSA Key Generation allows remote users to decrypt communications...

Code injection

SaltStack RSA Key Generation allows remote users to decrypt communications...

CVE-2013-2228

SaltStack RSA Key Generation allows remote users to decrypt communications...

CVE-2013-2228

SaltStack RSA Key Generation allows remote users to decrypt communications...

CVE-2013-2228

SaltStack RSA Key Generation allows remote users to decrypt communications...

CVE-2013-2228

Technical details about CVE-2013-2228 are not publicly provided in the supplied documents. Monitor for updates and new advisories.

CVE-2013-2228

Removed by vendor...

CVE-2013-2228: Improper Restriction of Excessive Authentication Attempts

SaltStack RSA Key Generation allows remote users to decrypt communications...

CVE-2011-4121

The OpenSSL extension of Ruby Git trunk versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation...