Improper Signature Validation

aws-database-encryption-sdk-dynamodb is vulnerable to Improper Signature Validation. The vulnerability occurs when a Set type is assigned a SIGNONLY attribute action. In such cases, there is a chance that the signature validation of the record containing a Set may fail during read, even if the Se...

In _executeSetSignatureValidator, validate data.signatureHash and data.signatureValidator for non-zero values.

Lines of code Vulnerability details M5 - In executeSetSignatureValidator, validate data.signatureHash and data.signatureValidator for non-zero values. poc: solidity function executeSetSignatureValidator internal returns bytes memory nextProgressData requiredata.signatureHash != bytes320, "Signatu...

Gitsign Security Vulnerabilities

Gitsign is a tool for Gitsign individual developers to sign Git commits key-free. A security vulnerability exists in Gitsign version 0.6.0 through versions prior to 0.8.0, which stems from the fact that the Rekor public key is obtained through the Rekor API, not through the local TUF client, and...

Signature malleability can occur by using EVM's ecrecover

Lines of code Vulnerability details Impact EVM's ecrecover is susceptible to signature malleability which allows replay attacks, check this. Proof of Concept OffChainSignatureValidator in its function isValidSignature checks for signature validity by using vulnerable method of ecrecover. address...

wrong return value of totalVotingPower leads to break the OffChainSignatureValidator#isValidSignature() functionality

Lines of code Vulnerability details Bug Description in the OffChainSignatureValidatorisValidSignature function we returns the singerVotingPowerBPS in term of BPSpoints by mul it by 1000 and the totalVotingPower is returned by calling the party.getGovernanceValues.totalVotingPower which is normal...

GO-2022-0758 Improper verification of signature attestations in github.com/sigstore/cosign

Improper verification of signature attestations in github.com/sigstore/cosign...

Signing DynamoDB Sets when using the AWS Database Encryption SDK.

Impact This advisory addresses an issue when a DynamoDB Set attribute is marked as SIGNONLY in the AWS Database Encryption SDK DB-ESDK for DynamoDB. This also includes when a Set is part of a List or a Map. DB-ESDK for DynamoDB supports SIGNONLY and ENCRYPTANDSIGN attribute actions. In version...

GHSA-72FP-W44G-625Q Signing DynamoDB Sets when using the AWS Database Encryption SDK.

Impact This advisory addresses an issue when a DynamoDB Set attribute is marked as SIGNONLY in the AWS Database Encryption SDK DB-ESDK for DynamoDB. This also includes when a Set is part of a List or a Map. DB-ESDK for DynamoDB supports SIGNONLY and ENCRYPTANDSIGN attribute actions. In version...

Improper Validation Of Attestations Signature

github.com/slsa-framework/slsa-verifier is vulnerable to Improper Validation Of Attestations Signature. An attacker could exploit this vulnerability by creating a malicious package and publishing it to a public npm registry. When a user installs the package, the slsa-verifier would verify the...

PT-2023-32985 · Amazon · Aws Database Encryption Sdk (Db-Esdk) For Dynamodb

Name of the Vulnerable Software and Affected Versions: AWS Database Encryption SDK DB-ESDK for DynamoDB versions 3.1.0 and below Description: The issue arises when a DynamoDB Set attribute is marked as SIGN ONLY in the AWS Database Encryption SDK DB-ESDK for DynamoDB, including when a Set is part...

PT-2023-9800 · Asyncssh +3 · Asyncssh +3

Name of the Vulnerable Software and Affected Versions: AsyncSSH versions prior to 2.14.1 Description: The issue in AsyncSSH allows attackers to control the extension info message via a man-in-the-middle attack, enabling them to conduct algorithm downgrade attacks during user authentication. This...

slsa-verifier vulnerable to mproper validation of npm's publish attestations

Summary slsa-verifier attestationstampered.json 5. SLSAVERIFIEREXPERIMENTAL=1 slsa-verifier verify-npm-package supreme-goggles.tgz --attestations-path attestationstampered.json --builder-id "https://github.com/actions/runner/github-hosted" --package-name "@trishankatdatadog/supreme-goggles"...

GHSA-R2XV-VPR2-42M9 slsa-verifier vulnerable to mproper validation of npm's publish attestations

Summary slsa-verifier attestationstampered.json 5. SLSAVERIFIEREXPERIMENTAL=1 slsa-verifier verify-npm-package supreme-goggles.tgz --attestations-path attestationstampered.json --builder-id "https://github.com/actions/runner/github-hosted" --package-name "@trishankatdatadog/supreme-goggles"...

Fedora 38 : open-vm-tools (2023-08e2bb6815)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-08e2bb6815 advisory. Security fixes for CVE-2023-34058 and CVE-2023-34059 Tenable has extracted the preceding description block directly from the Fedora security advisor...

Security Bulletin: Multiple vulnerabilities in jsonwebtoken package affects Data Replication on Cloud Pak for Data

Summary Multiple vulnerabilities in jsonwebtoken package used in Data Replication on Cloud Pak for Data was addressed. Vulnerability Details CVEID:CVE-2022-23541 DESCRIPTION: Auth0 jsonwebtoken could allow a remote authenticated attacker to bypass security restrictions, caused by an insecure...

grafana: plugin signature bypass

A flaw was found in the Grafana web application, where it is possible to install plugins which are not digitally signed. An admin could install unsigned plugins, which may contain malicious code...

libssh: authorization bypass in pki_verify_data_signature

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepkiverifydatasignature function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the retu...

Debian: Security Advisory (DLA-3646-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rocky Linux 8 : rpm (RLSA-2022:0368)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0368 advisory. - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a binding signature. RPM does not check the binding...

Rocky Linux 8 : gnome-software and fwupd (RLSA-2020:4436)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4436 advisory. - A PGP signature bypass flaw was found in fwupd all versions, which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is...