7689 matches found
Ubuntu 22.04 LTS : PyCryptodome vulnerability (USN-6595-1)
The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6595-1 advisory. It was discovered that PyCryptodome had a timing side-channel when performing OAEP decryption. A remote attacker could possibly use this issue to recover sensitiv...
GHSA-WJ6H-64FC-37MP Minerva timing attack on P-256 in python-ecdsa
python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the ecdsa.SigningKey.signdigest API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH...
Minerva timing attack on P-256 in python-ecdsa
python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the ecdsa.SigningKey.signdigest API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH...
Moderate: Red Hat Security Advisory: gnutls security update
An update for gnutls is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
gnutls: timing side-channel in the RSA-PSK authentication
A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding...
CVE-2024-23771
darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...
ALPINE-CVE-2024-23771
darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...
Authentication flaw
darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...
CVE-2024-23771
darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...
PT-2024-19718 · Apple · Ipados +4
Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.3 watchOS versions prior to 10.3 tvOS versions prior to 17.3 iOS versions prior to 17.3 iPadOS versions prior to 17.3 Description: A timing side-channel issue was addressed with improvements to constant-time...
darkhttpd security vulnerability
darkhttpd is a software application. When you need a web server. A security vulnerability exists in versions of darkhttpd prior to 1.15 that stems from the use of strcmp not constant time to verify authentication, making it easier for a remote attacker to bypass authentication via a timed side...
macOS 14.x < 14.3 Multiple Vulnerabilities (HT214061)
The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.3. It is, therefore, affected by multiple vulnerabilities: - The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS...
Medium: python-pycryptodomex
Issue Overview: PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. CVE-2023-52323 Affected Packages: python-pycryptodomex Issue Correction: Run dnf update python-pycryptodomex --releasever 2023.3.20240122 to update your...
Medium: python-pycryptodomex
Issue Overview: PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. CVE-2023-52323 Affected Packages: python-pycryptodomex Issue Correction: Run dnf update python-pycryptodomex --releasever 2023.3.20240122 or dnf update...
CVE-2024-23771
darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : GnuTLS vulnerabilities (USN-6593-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6593-1 advisory. It was discovered that GnuTLS had a timing side-channel when processing malformed ciphertexts in RSA-PSK ClientKeyExchange. A...
CVE-2024-23771
darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...
PT-2024-20075 · Darkhttpd · Darkhttpd
Name of the Vulnerable Software and Affected Versions: darkhttpd versions prior to 1.15 Description: The issue arises from the use of strcmp which is not constant time to verify authentication, making it easier for remote attackers to bypass authentication via a timing side channel. This allows...
Side Channel Vulnerability
Libgcrypt is vulnerable to Side Channel Vulnerability. The vulnerability is due to improper input validation within the Curve25519 algorithm located in cipher/ecc.c and mpi/ec.c. An attacker can possibly exfiltrate the private key as a result of this side channel attack...