PT-2022-25018 · Samsung · Samsung Mtower

Name of the Vulnerable Software and Affected Versions: Samsung mTower versions 0.3.0 and earlier Description: The issue is related to a missing check on the return value of EC KEY set private key in the sign pFwInfo function, leading to a denial of service. Recommendations: For Samsung mTower...

cryptofuzz:cryptofuzz-boringssl: Stack-buffer-overflow in wc_Shake256_Final

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5623509891547136 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Stack-buffer-overflow WRITE...

wolfssl:cryptofuzz-normal-math: Stack-buffer-overflow in wc_Shake256_Final

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5057208924110848 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-normal-math Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Addres...

Error while uploading CSR to renew APNS certificate

When customer attempts to upload a certificate signing request athttps://apnsui.xm.cloud.com/apns, they get an error message saying the upload failed, even though the CSR is created correctly...

[R1] Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities

R1 Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 08/24/2022 - 12:18 Custom audit files bring tremendous power and flexibility when assessing the configuration of your assets. Two separate vulnerabilities that utilize this custom Audit functionality were identified,...

CVE-2022-30262

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

Design/Logic Flaw

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

CVE-2022-30262: Insufficient Verification of Data Authenticity

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

CVE-2022-26305

An Improper Certificate Validation vulnerability was found in LibreOffice, where determining if a trusted author signed a macro was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro...

kernel security and bug fix update

3.10.0-1160.76.1.0.1.OL7 debug: lock down kgdb Orabug: 34270798 CVE-2022-21499 3.10.0-1160.76.1.OL7 Update Oracle Linux certificates Ilya Okomin Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] Update x509.genkey Orabug: 24817676 Confli...

GitHub Moves to Guard Open Source Against Supply Chain Attacks

The popular Microsoft-owned code repository plans to roll out code signing, which will help beef up the security of open source projects...

CVE-2022-35929

A flaw was found in the cosign package. The cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and when there are no attestations of the type being verified for example, —type defaults to...

kernel security and bug fix update

4.18.0-372.19.1.0.16.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

CVE-2022-35929 False positive signature verification in cosign

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

CVE-2022-35929 False positive signature verification in cosign

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

CVE-2022-35929

CVE-2022-35929 affects cosign prior to version 1.10.1. In cosign verify-attestation, using --type (default: custom) can yield a false positive when there is at least one attestation with a valid signature and no attestations of the type being verified. Repro example uses distroless image with a v...

CVE-2022-35929

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

CVE-2022-35929: Improper Verification of Cryptographic Signature

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

PT-2022-23034

Name of the Vulnerable Software and Affected Versions cosign versions prior to 1.10.1 Description The issue concerns a container signing and verification utility. In affected versions, cosign verify-attestation used with the --type flag can report a false positive verification when there is at...

cosign 数据伪造问题漏洞

cosign is a container signing, verification and storage in an OCI registry in the United States. A data forgery issue vulnerability exists in versions prior to cosign 1.10.1, which stems from the fact that the cosign verify-attestation --type may report a false positive if any attestation is...