httpsig-rs: HMAC verification is vulnerable to timing attack

Summary HMAC signature comparison is not timing-safe and is vulnerable to timing attacks. Details SharedKey::sign returns a Vec which has a non-constant-time equality implementation. Hmac::finalize returns a constant-time wrapper CtOutput which was discarded. Alternatively, Hmac has a constant-ti...

GHSA-Q7PG-9PR4-MRP2 httpsig-rs: HMAC verification is vulnerable to timing attack

Summary HMAC signature comparison is not timing-safe and is vulnerable to timing attacks. Details SharedKey::sign returns a Vec which has a non-constant-time equality implementation. Hmac::finalize returns a constant-time wrapper CtOutput which was discarded. Alternatively, Hmac has a constant-ti...

Exploit for Improper Verification of Cryptographic Signature in Pysaml2_Project Pysaml2

Technical Report on CVE-2021-21239: Redash SAML Authentication...

Linux Distros Unpatched Vulnerability : CVE-2018-12556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the...

EulerOS 2.0 SP10 : gnupg2 (EulerOS-SA-2025-2067)

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect...

phpseclib Cryptographic Signature Data Compromise

The vulnerability of the phpseclib cryptographic protocol library is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

...

Linux Distros Unpatched Vulnerability : CVE-2020-25860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time- of-Use vulnerability, where signature verification on ...

Linux Distros Unpatched Vulnerability : CVE-2021-20271

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seeming...

Linux Distros Unpatched Vulnerability : CVE-2021-28091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. CVE-2021-28091 Note that Nessus relies on the presence of the package ...

CGM CLININET Trust Management Issue Vulnerability

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from a trust management issue vulnerability that stems from the decodeParam function not verifying the signature algorithm, which can be exploited by an attacker to generate arbitrary user sessions...

Cisco IOS Cryptographic Signature Code Execution

The vulnerability of Cisco IOS network devices of the Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series switches is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2024-38807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to missing scalar checks in the Verify and prepareVerification functions. An attacker can produce multiple valid signatures for the same message by manipulating the S value in EdDSA a...

gnark 数据伪造问题漏洞

gnark is a fast zk-SNARK library open-sourced by Consensys. for advanced APIs to design circuits. A data forgery issue vulnerability exists in versions prior to gnark 0.14.0, which stems from incomplete signature verification and could lead to signature malleability attacks...

CVE-2025-55229

Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-55229

Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-55229: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network...

PT-2025-34295

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network. Recommendations: At the moment, there is no...

Microsoft Windows Certificates 数据伪造问题漏洞

Microsoft Windows Certificates is a digital certificate software from Microsoft Corporation USA. A data forgery vulnerability exists in Microsoft Windows Certificates that stems from improper cryptographic signature verification and could lead to spoofing attacks...