GHSA-77GC-FJ98-665H Go JOSE Signature Validation Bypass

Go JOSE before 1.1.0 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the...

opensc security, bug fix, and enhancement update

An update is available for opensc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The OpenSC set of libraries and utilities provides support for working with...

Moderate: opensc security, bug fix, and enhancement update

The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. Security Fixes: opensc: heap-based buffer overflow in...

Improper Access Control

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the...

CVE-2020-7731

This affects all versions 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

CVE-2020-7731

This affects all versions 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

Null pointer dereference

This affects all versions 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

CVE-2020-7731

The CVE-2020-7731 issue affects github.com/russellhaering/gosaml2 versions prior to 0.7.0, causing a nil-pointer dereference when processing malformed XML signatures. The vulnerability is fixed in v0.7.0 (released Mar 2, 2022). Remediation: upgrade to 0.7.0 or later. Workarounds mentioned in rela...

CVE-2020-7731 Denial of Service (DoS)

This affects all versions 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

Ubuntu: Security Advisory (USN-4892-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GitHub Missing Audit Logging

Original blog post here: https://wwws.nightwatchcybersecurity.com/2021/04/25/supply-chain-attacks-via-github-com-releases/ SUMMARY Release functionality on GitHub.com allows modification of assets within a release by any project collaborator. This can occur after the release is published, and...

USN-4892-1: OpenJDK vulnerability

It was discovered that OpenJDK incorrectly verified Jar signatures. An attacker could possibly use this issue to bypass intended security restrictions when using Jar files signed with a disabled algorithm...

USN-4892-1 openjdk-8, openjdk-lts vulnerability

It was discovered that OpenJDK incorrectly verified Jar signatures. An attacker could possibly use this issue to bypass intended security restrictions when using Jar files signed with a disabled algorithm...

bouncycastle: Timing issue within the EC math library

A flaw was found in bouncycastle. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures...

Mozilla: Race condition when reading from disk while verifying signatures

Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird 78.10...

CVE-2021-29948

Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird 78.10...

UBUNTU-CVE-2021-29948

Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird 78.10...

GPG error: The following signatures were invalid: KEYEXPIRED

End-of-Life Product Nutanix Mine with Veeam reached End-of-Life on 2026-04-30. As of this date, all support services for this product are unavailable. For more information, see the Nutanix EOL Announcement Bulletin - Nutanix Mine, released 2025-04-30. Challenge For the products of specific versio...

Mozilla Thunderbird Competitive Conditions Issue Vulnerability

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. A security bypass vulnerability exists in Mozilla Thunderbird, which can be exploited by...

Improper Verification of Cryptographic Signature in ansible

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the default behavior. This flaw...