EulerOS 2.0 SP5 : nss (EulerOS-SA-2022-1278)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

PT-2022-3152 · Rambus · Rambus Safezone Basic Crypto Module

Name of the Vulnerable Software and Affected Versions: Rambus SafeZone Basic Crypto Module versions prior to 10.4.0 Description: The issue is related to the generation of RSA keys that can be broken with Fermat's factorization method, allowing efficient calculation of private RSA keys from the...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2018-0732, CVE-2018-0737)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project on April 16, 2018 and June 12, 2018. OpenSSL, used by IBM Spectrum Control formerly Tivoli Storage Productivity Center , has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is...

CLSA-2022-1645466754 Fix of CVE: CVE-2021-43527

CVE-2021-43527: nss: Memory corruption in decodeECorDsaSignature with DSA signatures and RSA-PSS - Pin validation date for PayPalEE test cert...

USN-4478-2 python-rsa vulnerability

USN-4478-1 fixed a vulnerability in Python-RSA. This update provides the corresponding update for Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. Original advisory details: It was discovered that Python-RSA incorrectly handled certain ciphertexts. An attacker could possibly use this issu...

USN-4478-2: Python-RSA vulnerability

USN-4478-1 fixed a vulnerability in Python-RSA. This update provides the corresponding update for Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. Original advisory details: It was discovered that Python-RSA incorrectly handled certain ciphertexts. An attacker could possibly use this issu...

Google Cloud Service Account Private Key Disclosure

Google Cloud resources access control is managed through the Identify and Access Management IAM feature which helps defining the different roles and permissions available to authenticated principals. Principals include Google accounts for end users and service accounts which purpose is to be used...

SUSE SLES11 Security Update : strongswan (SUSE-SU-2022:14887-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14887-1 advisory. - In verifyemsapkcs1signature in gmprsapublickey.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on G...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022. I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn, Estonia on June 3, 2022. I’m speaking at the RSA Conference 2022 in San Francisco...

EulerOS Virtualization 3.0.6.0 : nettle (EulerOS-SA-2022-1084)

According to the versions of the nettle packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDS...

Huawei EulerOS: Security Advisory for nettle (EulerOS-SA-2022-1133)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for nettle (EulerOS-SA-2022-1084)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.6.6 : nettle (EulerOS-SA-2022-1133)

According to the versions of the nettle packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this fl...

Signatures are mistakenly recognized to be valid in jsrsasign

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack...

Rocky Linux 8 : nss (RLSA-2021:4903)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4903 advisory. - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures...

AlmaLinux 8 : python-cryptography (ALSA-2021:1608)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:1608 advisory. - python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS1 v1.5 ciphertext...

AlmaLinux 8 : gnutls and nettle (ALSA-2021:4451)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4451 advisory. - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for Unix

Summary There are multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for Unix. IBM Spectrum Protect Snapshot for Unix has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL coul...

CVE-2021-4160

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis...

OpenSSL: BN_mod_exp may produce incorrect results on MIPS (CVE-2021-4160) - Linux

OpenSSL is prone to a carry propagation vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...