CVE-2016-1000236

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

Type confusion

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

UBUNTU-CVE-2016-1000236

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

CVE-2016-1000236

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

CVE-2016-1000236

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

CVE-2016-1000236

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

CVE-2016-1000236

CVE-2016-1000236 affects the node-cookie-signature package prior to v1.0.6. Root cause: a timing-attack due to a non-constant-time comparison in signature verification. Impact: under favorable network conditions, an attacker could deduce the secret by exploiting slight timing differences (per-cha...

[SECURITY] [DLA 1999-1] symfony security update

Package : symfony Version : 2.3.21+dfsg-4+deb8u6 CVE ID : CVE-2019-18886 CVE-2019-18887 CVE-2019-18888 Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to a timing attack/information leak, argument injection and code execution via unserialization. For Debian ...

Timing Attack

simplito/elliptic-php is vulnerable to timing attack. The bit-length of the scalar is leaked during scalar multiplication on an elloptic curve, which can result in the recovery of the long-term private key generated by the library, due to inconsistent time during generation...

PT-2019-7510

Name of the Vulnerable Software and Affected Versions Node-cookie-signature versions prior to 1.0.6 Description The issue is related to a timing attack due to the use of a fail-early comparison instead of a constant-time comparison in the cookie-signature module. This type of comparison allows...

CVE-2016-1000236: Concurrent Execution using Shared Resource with Improper Synchronization

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

[SECURITY] [DSA 4573-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4573-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 18, 2019 https://www.debian.org/security/faq -...

CVE-2019-10764

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve whic...

Timing Attack

Overview simplito/elliptic-php is a Fast, general Elliptic Curve Cryptography library. Affected versions of this package are vulnerable to Timing Attack. Practical recovery of the long-term private key generated by the library is possible under certain conditions. Leakage of a bit-length of the...

PT-2019-5090

Name of the Vulnerable Software and Affected Versions Symfony versions 2.8.0 through 2.8.50 Symfony versions 3.4.0 through 3.4.34 Symfony versions 4.2.0 through 4.2.11 Symfony versions 4.3.0 through 4.3.7 Description The issue is related to the UriSigner in Symfony, which is subject to timing...

CVE-2019-10764: Observable Discrepancy

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve whic...

PT-2019-12036

Name of the Vulnerable Software and Affected Versions elliptic-php versions prior to 1.0.6 Description The issue allows for potential timing attacks, which under certain conditions, could lead to the practical recovery of the long-term private key generated by the library. This is due to the...

CVE-2019-16863

STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL...

Code injection

STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL...

CVE-2019-16863

STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL...