SUSE: Security Advisory (SUSE-SU-2018:2492-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:3762-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:3629-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2014:1510-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2017:1794-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RSA signature validation vulnerability on maleable encoded message in jsrsasign

Impact Vulnerable jsrsasign will accept RSA signature with improper PKCS1.5 padding. Decoded RSA signature value consists following form: 01ff...8 or more ffs...ff00ASN.1 OF DigestInfo Its byte length must be the same as RSA key length, however such checking was not sufficient. To make crafted...

GHSA-27FJ-MC8W-J9WG RSA signature validation vulnerability on maleable encoded message in jsrsasign

Impact Vulnerable jsrsasign will accept RSA signature with improper PKCS1.5 padding. Decoded RSA signature value consists following form: 01ff...8 or more ffs...ff00ASN.1 OF DigestInfo Its byte length must be the same as RSA key length, however such checking was not sufficient. To make crafted...

EulerOS Virtualization 2.9.1 : nss (EulerOS-SA-2021-1717)

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed...

EulerOS Virtualization 2.9.0 : nss (EulerOS-SA-2021-1744)

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m keynoting the all-virtual RSA Conference 2021, May 17-20, 2021. I’m keynoting the 5th International Symposium on Cyber Security Cryptology and Machine Learning via Zoom, July 8-9, 2021. I’ll be speaking at an Informa event on...

m2crypto: bleichenbacher timing attacks in the RSA decryption API

A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality...

Huawei EulerOS: Security Advisory for nss (EulerOS-SA-2021-1744)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for nss (EulerOS-SA-2021-1717)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

jsrsasign package data forgery issue vulnerability

jsrsasign package is an open source encryption library from the Japanese personal developer Kenji Urashima . A security vulnerability exists in Node.js jsrsasign package prior to 10.1.13, which stems from some invalid RSA pkc. No details of the vulnerability are provided at this time...

Diego F. Aranha relic input validation error vulnerability

Diego F.Aranha relic is a Diego F.Aranha open source application. A modern cryptographic meta-toolkit focusing on efficiency and flexibility. A security vulnerability exists in versions prior to RELIC 2020-08-01, which stems from an invalid RSA PKCS.No detailed vulnerability details are provided ...

Insecure Signature Verification

jsrsasign does not perform secure signature verification. certain invalid RSA PKCS1 v1.5 signatures are wrongly verified as valid, although there are no known practical attacks against the vulnerability...

Terrafrost phpseclib data forgery issue vulnerability

Terrafrost phpseclib is a Terrafrost open source application. pure PHP implementation of the MIT license. A data forgery issue vulnerability exists in Terrafrost phpseclib versions prior to 2.0.31 and 3.x series versions prior to 3.0.7, which stems from incorrectly handling the RSA PKCS.No detail...

CVE-2021-30246

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack...

CVE-2021-30246

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack...

CVE-2020-36315

In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...