4621 matches found
CVE-2024-21491
SVIX before version 1.17.0 is affected by an authentication bypass vulnerability in the Webhook verification logic. The root cause is an incorrect comparison of signatures of different lengths in the verify function, allowing an attacker to bypass signature verification by supplying a shorter sig...
CVE-2024-21491
Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of th...
CVE-2024-21491
Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of th...
CVE-2024-21491: Authentication Bypass Using an Alternate Path or Channel
Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of th...
CVE-2024-25714
In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. The fix uses gnutlsmemcmp, which has constant-time execution...
CVE-2024-25714
CVE-2024-25714 affects Rhonabwy up to 1.1.13. The HMAC signature verification uses a strcmp-based comparison that can leak timing information via a side-channel, as it stops at the first difference. The documented fix replaces this with a constant-time function (gnutls_memcmp). No exploitation de...
CVE-2024-25714: Observable Discrepancy
In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. The fix uses gnutlsmemcmp, which has constant-time execution...
PT-2024-21109 · Rhonabwy +1 · Rhonabwy +1
Name of the Vulnerable Software and Affected Versions: Rhonabwy versions 1.1.13 and earlier Description: The issue is related to HMAC signature verification, which uses a strcmp function. This function is vulnerable to side-channel attacks because it stops the comparison when the first difference...
CVE-2024-1150
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1...
Information disclosure
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1...
PT-2024-17034 · Snow · Snow Software Inventory Agent
Name of the Vulnerable Software and Affected Versions: Snow Software Inventory Agent on Unix versions through 7.3.1 Description: The issue is related to an Improper Verification of Cryptographic Signature vulnerability, which allows File Manipulation through Snow Update Packages. Recommendations:...
Buffer overflow
Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...
CVE-2023-51437 Apache Pulsar: Timing attack in SASL token signature verification
Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...
CVE-2023-51437 Apache Pulsar: Timing attack in SASL token signature verification
Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...
CVE-2023-51437: Observable Discrepancy
Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...
CVE-2024-21917: Improper Verification of Cryptographic Signature
A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a...
PT-2024-1615
Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk Service Platform affected versions not specified Description The issue is related to incorrect cryptographic signature verification in the FactoryTalk Services Platform, which can allow a remote attacker to gain...
GnuTLS Cryptographic Signature Verification DoS
The vulnerability of the transport-layer cryptographic library GnuTLS is related to errors in verifying the cryptographic signature. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures...
golang: crypto/tls: slow verification of certificate chains containing large RSA keys
A denial of service vulnerability was found in the Golang Go package caused by an uncontrolled resource consumption flaw. By persuading a victim to use a specially crafted certificate with large RSA keys, a remote attacker can cause a client/server to expend significant CPU time verifying...