CentOS Update for pcs CESA-2018:1060 centos7

Check the version of pcs SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882895";...

CVE-2016-1000341

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k...

Information disclosure

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k...

DEBIAN-CVE-2016-1000341

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k...

CVE-2016-1000341

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k...

CVE-2016-1000341

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k...

CVE-2016-1000341

CVE-2016-1000341 : The Bouncy Castle JCE Provider (BC-JCE) up to version 1.55 and earlier suffers a timing-side-channel in DSA signature generation. The lack of blinding can allow an observer to deduce the signature’s k value, potentially leaking the private key. The vulnerability is tied to the ...

CVE-2016-1000345: Undefined Security Weakness

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding...

PT-2018-4635 · Bouncy Castle +3 · Bouncy Castle Jce Provider +3

Name of the Vulnerable Software and Affected Versions: Bouncy Castle JCE Provider versions 1.55 and earlier Description: The issue concerns a timing attack vulnerability in DSA signature generation. When timings can be closely observed for the generation of signatures, the lack of blinding may...

PT-2018-4639

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions 1.55 and earlier Description The issue concerns a padding oracle attack in the DHIES/ECIES CBC mode. In environments where timings can be observed, an attacker can identify when decryption fails due to paddi...

CVE-2016-1000341: Undefined Security Weakness

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k...

CVE-2016-10535

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses ===, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than 1618288 guesses, instead of the 16^18 guesses...

CVE-2016-10535

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses ===, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than 1618288 guesses, instead of the 16^18 guesses...

CVE-2016-10535

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses "===", a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than 1618288 guesses, instead of the 16^18 guesses...

PT-2018-4714

Name of the Vulnerable Software and Affected Versions csrf-lite versions prior to 0.1.2 Description The issue concerns a timing attack vulnerability due to the use of a fail-first string comparison instead of a constant-time comparison when testing CSRF tokens. This allows an attacker to guess th...

CentOS 7 : pcs (CESA-2018:1060)

An update for pcs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

HackerOne: Information disclosure

Summary: Chaining few simple informative issues on HackerOne platform and applying new method of timing attack, exploiting interesting feature in HTML5 https://developer.mozilla.org/en-US/docs/Web/API/ResourceTimingAPI/UsingtheResourceTimingAPI more precise Copy with CORSwe can perform low cost,...

USN-3628-1: OpenSSL vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia discovered that OpenSSL incorrectly handled RSA key generation. An attacker could possibly use this issue to...

HackerOne: Timing attack towards endpoints on the web without CSRF

Summary: When logged in user on HackerOne visits another web page, remote web page could get conclusion regarding this data: - logged in user - number of triaged reports in the last month - number of new reports at the moment - number of closed reports ... This conclusions are only from one...

pcs security update

0.9.162-5.0.3.el75.1 - Unlike RHEL we DO have corosync/pacemaker for aarch64 on EL7 - replace logo pcsd/public/favicon.ico in tarball - remove Source1 HAM-logo.png 0.9.162-5.el75.1 - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure - Fixed CVE-2018-1079 pcs...