UBUNTU-CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

PT-2020-5164

Name of the Vulnerable Software and Affected Versions PySAML2 versions prior to 5.0.0 Description The issue is related to incorrect verification of cryptographic signatures in SAML2 documents, allowing a remote attacker to bypass signature checks and access protected information. This is due to t...

CVE-2019-14859

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable...

CVE-2019-14859

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable...

The vulnerabilities of McAfee Total Protection (MTP), McAfee Anti-Virus Plus (AVP), and McAfee Internet Security (MIS) software lie in their shortcomings regarding the loading of external files and the verification of their digital signatures. This allows attackers to exploit these vulnerabilities to enhance their privileges and execute malicious code.

The vulnerabilities of McAfee Total Protection MTP, McAfee Anti-Virus Plus AVP, and McAfee Internet Security MIS are related to deficiencies in loading external files from inappropriate directories and verifying their digital signatures. Exploiting these vulnerabilities can allow attackers to...

The vulnerability of the Omnibox component in the Google Chrome browser allows attackers to perform spoofing attacks.

The vulnerability of the Omnibox component in Google Chrome relates to deficiencies in the mechanism for verifying digital signatures. Exploiting this vulnerability allows a malicious actor to carry out spoofing attacks using a specially created domain name...

Unspecified vulnerability in NVIDIA GeForce Experience local service provider component

NVIDIA Windows GPU Display Driver and NVIDIA GeForce Experience are both products of NVIDIA Corporation.NVIDIA Windows GPU Display Driver is a graphics processor GPU driver for the Windows platform. NVIDIA GeForce Experience is a set of automatic graphics card update tools. The product can...

EulerOS 2.0 SP5 : php (EulerOS-SA-2019-2221)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ext/standard/varunserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to caus...

Signature Verification Bypass

robrichards/xmlseclibs is vulnerable to signature verification bypass. The implementation of the SAML 2.0 protocol allows for the circumvention of XML signature verification on SAML messages due to the failure to ensure only a single SignedInfo element exists within the signature...

Debian DSA-4560-1 : simplesamlphp - security update

It was discovered that in SimpleSAMLphp, an implementation of the SAML 2.0 protocol, it was possible to circumvent XML signature verification on SAML messages. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DLA-1983-1 : simplesamlphp security update

It was discovered that in SimpleSAMLphp, an implementation of the SAML 2.0 protocol, it was possible to circumvent XML signature verification on SAML messages. For Debian 8 'Jessie', this problem has been fixed in version 1.13.1-2+deb8u3. We recommend that you upgrade your simplesamlphp packages...

[SECURITY] Fedora 31 Update: python-ecdsa-0.13.3-1.fc31

This is an easy-to-use implementation of ECDSA cryptography Elliptic Curve Digital Signature Algorithm, implemented purely in Python, released under the MIT license. With this library, you can quickly create keypairs signing key and verifying key, sign messages, and verify the signatures. The key...

CVE-2019-14859

A flaw was found in python-ecdsa, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false...

GHSA-PWFW-MGFJ-7G3G ecdsa Denial of Service vulnerability in signature verification and signature malleability

possible DoS in signature verification and signature malleability Impact Code using VerifyingKey.verify and VerifyingKey.verifydigest may receive exceptions other than the documented BadSignatureError when signatures are malformed. If those other exceptions are not caught, they may lead to progra...

ecdsa Denial of Service vulnerability in signature verification and signature malleability

possible DoS in signature verification and signature malleability Impact Code using VerifyingKey.verify and VerifyingKey.verifydigest may receive exceptions other than the documented BadSignatureError when signatures are malformed. If those other exceptions are not caught, they may lead to progra...

CVE-2019-10181

It was found that executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox...

Cisco NX-OS Software Virtual Service Image Signature Bypass Vulnerability

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability. The vulnerability allows an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device...

The vulnerability of NX-OS and Cisco IOS XE operating systems arises from errors during the verification of the electronic signature when installing an Open Virtual Appliance (OVA) image. This vulnerability allows a perpetrator to install malware onto a vulnerable device.

The vulnerability of NX-OS and Cisco IOS XE operating systems is related to errors during the verification of the electronic signature when installing an Open Virtual Appliance OVA image. Exploiting this vulnerability allows a perpetrator to install malware onto a vulnerable device...

Cisco Patches 13 High-Severity Router and Switch Bugs

Cisco Systems released patches for 29 bugs Wednesday that addressed flaws in a wide range of its products including routers and switches running the IOS XE networking software. Thirteen of the vulnerabilities revealed are rated high severity. The bulk of the high-severity vulnerabilities are tied...