CVE-2016-6298

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

Design/Logic Flaw

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

PYSEC-2016-4

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

UBUNTU-CVE-2016-6298

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

CVE-2016-6298

The CVE-2016-6298 issue affects the jwcrypto Python package, specifically the RSA 1.5 implementation (the _Rsa15 class in jwa.py). Before 0.3.2, it lacks the Random Filling protection mechanism, enabling a remote attacker to potentially obtain cleartext data via a Million Message Attack (MMA). Th...

Updated nettle/nettle2.7 packages fix security vulnerability

The cryptographic library nettle had a potential information leak problem reported. RSA code is vulnerable to cache sharing related attacks CVE-2016-6489...

MGASA-2016-0290 Updated nettle/nettle2.7 packages fix security vulnerability

The cryptographic library nettle had a potential information leak problem reported. RSA code is vulnerable to cache sharing related attacks CVE-2016-6489...

Nettle RSA Information Disclosure Vulnerability

Nettle is a library of basic cryptographic functions. An information disclosure vulnerability exists in Nettle RSA, which allows an attacker to exploit the vulnerability to obtain sensitive information...

openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)

It was discovered that OpenSSL would accept ephemeral RSA keys when using non-export RSA cipher suites. A malicious server could make a TLS/SSL client using OpenSSL use a weaker key exchange method...

CVE-2016-0915

The Self-Service Portal in EMC RSA Authentication Manager AM Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service PIN change for an arbitrary user via a modified token serial number within a PIN change request, related to a "direct...

Design/Logic Flaw

The Self-Service Portal in EMC RSA Authentication Manager AM Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service PIN change for an arbitrary user via a modified token serial number within a PIN change request, related to a "direct...

CVE-2016-0915

The Self-Service Portal in EMC RSA Authentication Manager AM Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service PIN change for an arbitrary user via a modified token serial number within a PIN change request, related to a "direct...

CVE-2016-0915

CVE-2016-0915 affects the Self-Service Portal in EMC RSA Authentication Manager Prime Self-Service 3.0 and 3.1 (before 3.1 1915.42871). The vulnerability is a direct object reference flaw that allows remote authenticated users to cause a denial of service by altering a token serial number within ...

Debian DSA-3649-1 : gnupg - security update

Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of GnuPG's random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. A first analysis on the impact of this bug...

DSA-3650-1 libgcrypt20 - security update

Bulletin has no description...

Debian DLA-593-1 : nettle security update

The cryptographic library nettle had a potential information leak problem reported. CVE-2016-6489 RSA code is vulnerable to cache sharing related attacks. For Debian 7 'Wheezy', this problems has been fixed in version 2.4-3+deb7u1. We recommend that you upgrade your nettle packages. NOTE: Tenable...

FreeBSD : FreeBSD -- Multiple OpenSSL vulnerabilities (7b1a4a27-600a-11e6-a6c3-14dae9d210b8) (DROWN)

A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable servers can be decrypted provided another server supporting...

[SECURITY] [DLA 593-1] nettle security update

Package : nettle Version : 2.4-3+deb7u1 CVE ID : CVE-2016-6489 Debian Bug : 832983 The cryptographic library nettle had a potential information leak problem reported. CVE-2016-6489 RSA code is vulnerable to cache sharing related attacks. For Debian 7 "Wheezy", this problems has been fixed in...

DLA-593-1 nettle - security update

Bulletin has no description...

Export-Grade Crypto Patching Improves

LAS VEGAS – The FREAK, LOGJAM and DROWN attacks of the last 17 months weren’t just the work of academics and security researchers who found a cool way to unmask encrypted traffic. They were ugly reminders of the Crypto Wars of the 1990s and why export-grade cryptography and intentional encryption...