interrogate

Interrogate Interrogate는 바이너리 자료에서 암호화 키를 식별하기 위한 개념 증명 도구입니다 대상 운영 체제에 관계없이, 주로 메모리 덤프 분석 및 포렌식 용도로 사용됩니다. 버전 0.0.4 기준으로 AES, Serpent, Twofish 및 DER 인코딩된 RSA 키를 식별할 수 있습니다. 이 도구는 NTNU에서의 석사 학위 논문의 일부로 작성되었습니다. 핵심 데이터 버전: 0.0.4 라이선스: GPL 저자: Carsten Maartmann-Moe [email protected] 트위터:...

CryKeX

Propriétés : Multiplateforme Minimalisme Simplicité Interactivité Compatibilité/Portabilité Indépendant de l'application Encapsulation de processus Injection de processus Dépendances : Unix - devrait fonctionner sur tout système d'exploitation basé sur Unix BASH - l'ensemble du script privilèges...

zeek-plugin-roca

Johanna::ROCA يقوم هذا الملحق بتنفيذ كشف المفاتيح المتأثرة بـ CVE-2017-15361؛ وهو إعادة تطبيق للمصدر المتاح على https://github.com/crocs-muni/roca. يوفر هذا الملحق وظيفتين جديدتين BIFs يمكنهما فحص المفاتيح العامة: rocavulnerablecert تتحقق مما إذا كانت الشهادة معرضة للخطر rocavulnerablemod تتحقق م...

poc-CVE-2026-0073

CVE-2026-0073 PoC Contournement de l'authentification TLS ADB sans fil Ce répertoire contient une preuve de concept Python pour CVE-2026-0073. Le script est généré à l'aide de techniques de génération de code assistée par IA. Résumé CVE-2026-0073 est un problème logique dans la vérification des...

CVE-2021-21239

CVE-2021-21239 Ceci est un script PoC pour exploiter la vulnérabilité xmlsec CVE-2021-21239 Pour utiliser ce script, vous pouvez soit construire l'image Docker, soit fournir vous-même une clé RSA et l'exécuter en supposant que xmlsec est installé Info sur la vulnérabilité :...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by use of a broken cryptographic algorithm vulnerability due to Paramiko

Summary Paramiko is used by IBM Cloud Pak for Data System 1.0 as a Python implementation of the SSH protocol for secure remote connections and file transfers. CVE-2026-44405 affects Paramiko's RSA key handling in rsakey.py, where the SHA-1 algorithm is permitted for cryptographic operations despi...

Astra Linux – Vulnerability in mbedtls

The use of a broken or risky cryptographic algorithm in the function mbedtlsmpiexpmod in lignum.c in Mbed TLS for all versions prior to 3.0.0, 2.27.0, or 2.16.11 allows attackers with access to precise timing and memory access information typically from an untrusted operating system attacking a...

JLSEC-2026-565 In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the...

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys...

UBUNTU-CVE-2026-39829

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public...

Astra Linux – Vulnerability in mbedtls

In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability exists in the decoding of Base64 PEM files. This vulnerability allows system-level administrator attackers to obtain information about secret RSA keys through a controlled-channel and side-channel attack on software running in...

libjwt 加密问题漏洞

LibJWT is a C-language library developed by Ben Collins, designed for generating and verifying JSON Web Tokens. Versions 3.0.0 to 3.3.2 of LibJWT contain vulnerabilities related to encryption. These vulnerabilities arise from accepting RSA JWKs without an alg parameter as the verification key for...

CVE-2026-44167

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files eg. X509 certificates, RSA PKCS8 private or public keys, etc. This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52...

EUVD-2026-28934

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key e.g...

CVE-2026-42576

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key e.g...

apko 代码问题漏洞

Apko is an open-source OCI image builder based on APK. Versions of Apko prior to 1.2.7 had code vulnerabilities. These vulnerabilities stemmed from DiscoverKeys’ unconditional assertion of JWKS key types as rsa.PublicKey without checking the key type. This could lead to panic and crashes due to...

GHSA-2F25-PFQ3-C7H8 Phpseclib needs guardrails on large binaryfield integers

Impact Anyone loading untrusted ASN1 files eg. X509 certificates, RSA PKCS8 private or public keys, etc Patches https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f Workarounds No. References...

phpseclib guardrails needed on OID length

Impact Any application using that loads untrusted ASN1 files eg. X509 certificates, RSA PKCS8 private or public keys, etc. Patches https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59 Workarounds No. Resources...

CVE-2026-44405

Paramiko up to 4.0.0 (before commit a4489456b6f65281e172380cc4826cee5e851dbb) permits SHA-1 in rsakey.py. Affected: Paramiko’s RSA key handling. Root cause: use of SHA-1 algorithm. Impact: low (Confidentiality: None, Integrity: Low). Remediation: apply the patch introduced in the a448945 commit (...

phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

Impact Anyone loading untrusted ASN1 files eg. X509 certificates, RSA PKCS8 private or public keys, etc Patches https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc Workarounds No. References...

Incorrect Type Conversion or Cast

Overview Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast in the DiscoverKeys process. An attacker can cause the application to crash by providing a non-RSA key such as an EC key from a repository JWKS endpoint, which triggers a panic due to an unchecked type...