Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : Tang vulnerability (USN-6489-1)

The remote Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6489-1 advisory. Brian McDermott discovered that Tang incorrectly handled permissions when creating/rotating keys. A local attacker could possibly...

MAL-2023-8538 Malicious code in mxtorie-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fedc7ad7359a3d2943f91008333517119b1cb29a70bd4e98c198f052229e62e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2023-1672

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host...

Malicious code in ifl-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15d842c50e1aff05fb5874d61c1f60e5a803cc51a39cda09deb405e5c6935bce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8537 Malicious code in node-common-npm-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02090694bde3634ac057c9ea4e4f37e4f65c597af5c1490bbe56a25e7acb8031 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xpub-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc3e9ded369fe8fed74a7f23ab0c33cbbda2a1e16aab8c2283faba59903c49d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8533 Malicious code in xpub-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc3e9ded369fe8fed74a7f23ab0c33cbbda2a1e16aab8c2283faba59903c49d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8531 Malicious code in vpc-nat-gateway-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9417e9eb52b089fd432e5dd38464df3ef02177d6b0d26f9fc664ef56591c4ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8529 Malicious code in f0-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d39b919f598c91daf62eb8ac34de91c6290cd75d798de1ea5f7b9c3690cab44d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spotify-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6884d2a77686f419c030b7aabf153bc9524a9065a79051850a4dc0715d197267 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8522 Malicious code in discord-web-stream.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34fa39c7559a1834d28c5b1e0b3470965c15470b60f2f9c1a196a823e394a49f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8519 Malicious code in oasis-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bbbb6d6d51b6b4eae513979526b1a1d3c7c7b9947f319737a35fe899336adfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Linux 9 : tang (ELSA-2023-6492)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-6492 advisory. 14-2 - Fix service start up 14-1 - New upstream release - v14. Resolves: rhbz2182411 Resolves: CVE-2023-1672 Tenable has extracted the preceding description blo...

MAL-2023-8518 Malicious code in update-packager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 594a5a70a75839b33f042d76c062a1d1d643b28f842472e9f5b0f95962aeb78f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8517 Malicious code in @airslate/front-locales (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e41b723776c055272b1cc4c219aba6cfae1a13b0ff87d90e8f0667b79d626e00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

tang: Race condition exists in the key generation and rotation functionality

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host...

CentOS 8 : tang (CESA-2023:7022)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7022 advisory. - A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys...

ALSA-2023:7022 Moderate: tang security and bug fix update

Tang is a server for binding data to network presence. It includes a daemon which provides cryptographic operations for binding to a remote service. The tang package provides the server side of the Network Bound Disk Encryption NBDE project. Security Fixes: tang: Race condition exists in the key...

MAL-2023-8511 Malicious code in iproduce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9793afabdea98cc294df5335305541ec8d48c6f0fe655e511f82c46d2bd5685 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8506 Malicious code in ifl-primitives (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cbddd298006615ef0975b9e718d03ba67c4cf761be2dc4048648ebd2866c0fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...