CVE-2020-36316: Buffer Copy without Checking Size of Input

In RELIC before 2021-04-03, there is a buffer overflow in PKCS1 v1.5 signature verification because garbage bytes can be present...

CVE-2020-36315: Use of a Broken or Risky Cryptographic Algorithm

In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...

PT-2021-11999

Name of the Vulnerable Software and Affected Versions: RELIC versions prior to 2020-08-01 Description: The issue allows RSA PKCS1 v1.5 signature forgery due to inadequate checks of the padding and the first two bytes. This requires a low public exponent, such as 3, which is not the default for...

relic:cryptofuzz-relic: Use-of-uninitialized-value in bool std::__1::equal<std::__1::__wrap_iter<unsigned char const*>, std::__1::__wr

Detailed Report: https://oss-fuzz.com/testcase?key=5163656552775680 Project: relic Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-relic Job Type: libfuzzermsanrelic Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: bool std::1::equal, std::1::wr bool...

New Relic: User without "View/Modify/Delete" permissions on "Destinations" can view/modify & delete Destinations

@archangel reported that an elevation-of-privilege in the Destinations functions could have allowed a user to view Destinations without having the rights to do so due to an IDOR Incorrect Direct Object Reference...

New Relic: Missing Authorization check on View permissions for Alerting Conditions via /internal_api/1/accounts/XXXXXXX/policies/YYYYYYY/conditions?offs endpoint

@archangel reported that an elevation-of-privilege due to a missing authorization check on View permissions for Alerting Conditions could have allowed a user to see alerting policies without having the rights to do so...

New Relic: Untrusted deserialization issue when loading newrelic.yml file in Java agent leads to code execution on host

Hi team, The New Relic Java agent is using SnakeYAML for deserialization of the newrelic.yml config file. SnakeYAML has a 'feature' which can lead to code execution, this is documented here. With the !!com.some.Class "arg1", "arg2" notation it's possible to call Java code during the deserializati...

PT-2021-28062

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow error, specifically a WRITE 8 operation. The crash state involves functions such as bn sqr karat imp and bn...

relic:cryptofuzz-relic: Heap-buffer-overflow in bn_sqr_karat_imp

Project: https://github.com/relic-toolkit/relic.git Detailed Report: https://oss-fuzz.com/testcase?key=6308222224957440 Project: relic Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-relic Job Type: libfuzzerasanrelic Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address:...

relic:cryptofuzz-relic: Use-of-uninitialized-value in bn_trim

Detailed Report: https://oss-fuzz.com/testcase?key=4803788135333888 Project: relic Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-relic Job Type: libfuzzermsanrelic Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: bntrim bnaddimp bnadd Sanitizer: memory MSA...

relic:cryptofuzz-relic: Heap-use-after-free in bn_rshb_low

Project: https://github.com/relic-toolkit/relic.git Detailed Report: https://oss-fuzz.com/testcase?key=4515232032620544 Project: relic Fuzzing Engine: honggfuzz Fuzz Target: cryptofuzz-relic Job Type: honggfuzzasanrelic Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address:...

relic:cryptofuzz-relic: Use-of-uninitialized-value in cryptofuzz::module::relic_bignum::Bignum::baseConversion

Detailed Report: https://oss-fuzz.com/testcase?key=6335468096585728 Project: relic Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-relic Job Type: libfuzzermsanrelic Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

relic:cryptofuzz-relic: Heap-buffer-overflow in bn_div1_low

Project: https://github.com/relic-toolkit/relic.git Detailed Report: https://oss-fuzz.com/testcase?key=5181102790672384 Project: relic Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-relic Job Type: libfuzzerasanrelic Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address:...

New Relic: Account Takeover via Email ID Change and Forgot Password Functionality

@dsdh discovered an issue with the email change flow, where emails would be sent to the new email address prior to that address being verified. An attacker could have abused this issue to access vulnerable user accounts...

relic:cryptofuzz-relic: Stack-buffer-overflow in bn_rec_slw

Project: https://github.com/relic-toolkit/relic.git Detailed Report: https://oss-fuzz.com/testcase?key=5658029280329728 Project: relic Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-relic Job Type: libfuzzerasanrelic Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 1 Crash Address:...

CVE-2020-36189

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource...

UBUNTU-CVE-2020-36189

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource...

New Relic: Stored XSS via malicious key value of Synthetics monitor tag when visiting an Insights dashboard with filtering enabled

Introduction & Context This is a complex XSS that requires multiple steps in order to setup. It also requires you to have a good understanding of both New Relic Insights, New Relic Synthetics monitors, and the NerdGraph API explorer. Background Context: New Relic Synthetics and the history of tag...

New Relic: Account takeover by using abandoned email id of victim which has already been changed to new by victim himself on one.newrelic.com

@ashmek identified an inconsistency with account mapping between New Relic One and the discussion forum. This resulted in a situation where a user who has changed their email address could have contents of their account displayed to a new user who had access to the original email address...

New Relic: removed user can still join the organization

hi, i would like to report an issue i have found that allow attacker to join organization even if the attacker is removed. i found out that when adding new user, if you add a new user without verifying the email address, you change the email of the user, the email address you initially send the...