DEBIAN-CVE-2020-25658

It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA...

CVE-2020-25658: Covert Timing Channel

It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA...

hw: Fast forward store predictor

A flaw was found in the CPU microarchitecture where a local attacker is able to abuse a timing issue which may allow them to infer internal architectural state from previous executions on the CPU...

hw: Fast forward store predictor

A flaw was found in the CPU microarchitecture where a local attacker is able to abuse a timing issue which may allow them to infer internal architectural state from previous executions on the CPU...

Insecure RSA Decryption (Bleichenbacher Timing Attack)

rsa is using insecure RSA Decryption and is vulnerable to Bleichenbacher Timing attack. The library provides enough of a timing side channel to mount a Bleichenbacher style attack as it uses timed processing of valid PKCS1 v1.5 ciphertext...

CentOS 7 : nss and nspr (RHSA-2020:4076)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4076 advisory. - When importing a curve25519 private key in PKCS8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Securi...

Moderate: Red Hat Security Advisory: libgcrypt security, bug fix, and enhancement update

An update for libgcrypt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

libgcrypt: ECDSA timing attack allowing private key leak

A timing attack was found in the way ECCDSA was implemented in libgcrypt. A man-in-the-middle attacker could use this attack during signature generation to recover the private key. This attack is only feasible when the attacker is local to the machine where the signature is being generated. Attac...

RHEL 8 : libgcrypt (RHSA-2020:4482)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4482 advisory. The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. The following packages have been upgraded to a...

Moderate: libgcrypt security, bug fix, and enhancement update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. The following packages have been upgraded to a later upstream version: libgcrypt 1.8.5. BZ1764918 Security Fixes: libgcrypt: ECDSA timing attack allowing private key leak CVE-2019-13627 For more...

UBUNTU-CVE-2020-25659

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS1 v1.5 ciphertext...

rack-protection: Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

rubygem-rack: hijack sessions by using timing attacks targeting the session id

A flaw was found in rubygem-rack in versions prior to 1.6.12 and 2.0.8. An information leak may allow an attacker to find and hijack sessions using timing attacks targeting the session ID. The highest threat from the vulnerability is to data confidentiality...

PT-2020-6703

Name of the Vulnerable Software and Affected Versions python-cryptography versions 3.2 Description The issue is related to errors in RSA key management in the python-cryptography package for the Python programming language. It may allow a remote attacker to gain unauthorized access to protected...

CVE-2020-4661

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system. IBM X-Force ID: 186142...

Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-5407 DESCRIPTION: Simultaneous Multi-threading SMT in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port...

Timing Attack

Overview shrine is a toolkit for file attachments in Ruby applications. Affected versions of this package are vulnerable to Timing Attack when using the derivationendpoint plugin, allowing the attacker to guess the signature of the derivation URL. Remediation Upgrade shrine to version 3.3.0 or...

Timing Attack

shrine is vulnerable to a timing attack. Failure to compare sent and calculated signatures in constant time allows an attacker to guess the signature of the derivation URL during the use of derivationendpoint plugin...

CVE-2020-15237

In Shrine before version 3.3.0, when using the derivationendpoint plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using Rack::Utils.securecompare...

CVE-2020-15237

In Shrine before version 3.3.0, when using the derivationendpoint plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using Rack::Utils.securecompare...