CVE-2022-4499

CVE-2022-4499 affects TP-Link WR710N-V1-151022 and Archer C5-V2-160201 (TP-Link routers). The vulnerability arises from a side-channel attack on the httpd process, specifically a strcmp() used to verify credentials, allowing an attacker to deterministically guess each byte of the username and pas...

GLSA-202301-08 : Mbed TLS: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202301-08 Mbed TLS: Multiple Vulnerabilities - A Lucky 13 timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affec...

CVE-2022-48251

The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by or related to the Arm architecture."...

CVE-2022-48251

The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by or related to the Arm architecture."...

Code injection

The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by or related to the Arm architecture."...

ARM Armv8 安全漏洞

ARM Armv8 is a processor architecture from the British company ARM. ARM Armv8 has a security vulnerability that stems from the fact that it is not inherently resistant to side-channel attack algorithms...

CVE-2022-48251

CVE-2022-48251 concerns ARMv8 AES instructions, which are described as lacking an algorithm that is intrinsically resistant to power-side-channel attacks. Multiple sources reiterate that power-side-channel attacks are possible but not directly caused by or related to ARM architecture, with no spe...

CVE-2022-48251

The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by or related to the Arm architecture."...

PT-2023-15648 · Arm · Armv8

Name of the Vulnerable Software and Affected Versions: ARMv8 affected versions not specified Description: The AES instructions on the ARMv8 platform do not have an algorithm that is intrinsically resistant to side-channel attacks. The vendor notes that while power side channel attacks are possibl...

Information Disclosure

srp is vulnerable to information disclosure. The vulnerability exists because the BNmodexp is called with a small base and without constant time flag fall back on OpenSSL with insecure implementation of ctsrp.py, allowing an attacker to gain sensitive information through side channel leaks...

robbert229/jwt's token validation methods vulnerable to a timing side-channel during HMAC comparison

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC...

GHSA-5VW4-V588-PGV8 robbert229/jwt's token validation methods vulnerable to a timing side-channel during HMAC comparison

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC...

CVE-2015-10004

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC...

Design/Logic Flaw

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC...

CVE-2015-10004

CVE-2015-10004 corresponds to a timing side-channel vulnerability in the token validation path of the github.com/robbert229/jwt library. The underlying issue is a flawed HMAC comparison that leaks timing information, enabling an attacker to infer the expected HMAC with a high likelihood under a h...

CVE-2015-10004 Timing side-channel in github.com/robbert229/jwt

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC...

CVE-2015-10004 Timing side-channel in github.com/robbert229/jwt

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC...

GHSA-XMC3-9M9J-W9X4 cocagne pysrp vulnerable to side channel leaks

A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculatex of the file srp/ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. T...

Jwt 安全漏洞

Jwt is a simple library that uses Json Web Token and Json Web Signature. Jwt suffers from a security vulnerability that stems from the susceptibility of the token validation method to timing side channels during HMAC comparisons...

Debian dla-3249 : libmbedcrypto3 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3249 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3249-1 [email protected]...