kernel: crypto: s390/aes - Fix buffer overread in CTR mode

In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and cop...

NXP Data Co-Processor Security Vulnerability

The NXP Data Co-Processor NXP DCP is a built-in hardware module for a SoC from NXP. A dedicated AES encryption engine used to implement encryption/decryption operations. A security vulnerability exists in NXP Data Co-Processor that originates from the selection of a test key by the dcptool...

PT-2024-28058 · Nxp · Nxp Data Co-Processor

Name of the Vulnerable Software and Affected Versions: NXP Data Co-Processor DCP affected versions not specified Description: The issue concerns the NXP Data Co-Processor DCP, a built-in hardware module for specific NXP SoCs that implements a dedicated AES cryptographic engine for...

CVE-2024-5264

Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis...

Zoom Announces Advanced Encryption for Increased Meeting Security

By Deeba Ahmed Your Zoom meetings are now more secure than ever! This is a post from HackRead.com Read the original post: Zoom Announces Advanced Encryption for Increased Meeting Security...

AZL-59490 CVE-2024-26789 affecting package kernel for versions less than 6.6.85.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: arm64/neonbs - fix out-of-bounds access on short input The bit-sliced implementation of AES-CTR operates on blocks of 128 bytes, and will fall back to the plain NEON version for tail blocks or inputs that are shorter than...

CVE-2023-47150

IBM Common Cryptographic Architecture CCA 7.0.0 through 7.5.36 could allow a remote user to cause a denial of service due to incorrect data handling for certain types of AES operations. IBM X-Force ID: 270602...

IBM Common Cryptographic Architecture 资源管理错误漏洞

IBM Common Cryptographic Architecture is a cryptographic platform from International Business Machines IBM. It provides a number of features to protect financial transactions. A resource management error vulnerability exists in IBM Common Cryptographic Architecture CCA versions 7.0.0 through 7.5....

PubNub Security Breach

PubNub is a library of PubNub open source . It is used to take care of the infrastructure and APIs required to handle the real-time communication layer of an application. PubNub suffers from a security vulnerability that stems from an inefficient implementation of the AES-256-CBC encryption...

Plaintext exposed in decrypt_in_place_detached even on tag verification failure

Summary In the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. Impact If a program using the aes-gcm crate's decryptinplace APIs accesses the buffer after decryption failure, it will contain a...

GHSA-FXFF-WXXV-C2JC PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining CBC mode in AES encryption. This vulnerability can lead to the disclosure of information and communications...

CVE-2023-48056

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining CBC mode in AES encryption. This vulnerability can lead to the disclosure of information and communications...

CVE-2023-48053

Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining CBC mode in AES encryption. This vulnerability can lead to the disclosure of information and communications...

PYSEC-2023-245

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining CBC mode in AES encryption. This vulnerability can lead to the disclosure of information and communications...

Archery Security Vulnerabilities

Archery is an open source set of vulnerability assessment and management tools. A security vulnerability exists in Archery version v1.10.0 that stems from the use of non-random or static IVs for Cipher Block Linking CBC mode in AES encryption, which could lead to information and communication...

PT-2023-12785 · Texas Instruments · Texas Instruments Omap L138

Name of the Vulnerable Software and Affected Versions: Texas Instruments OMAP L138 secure variants affected versions not specified Description: The AES implementation in the Texas Instruments OMAP L138 suffers from a timing side channel. This can be exploited by an adversary with non-secure...

aes-gcm Data Forgery Issue Vulnerability

aes-gcm is a cryptographic algorithm in the aes-gcm open source. Vulnerabilities in aes-gcm versions prior to 0.10.0 to 0.10.3 suffer from a data forgery problem, which stems from the fact that in AES GCM decryption implementations, plaintext is made public in the form of decryptinplacedetached...

AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

In the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails...

USN-6307-1 cjose vulnerability

It was discovered that JOSE for C/C++ AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. An attacker could use this to cause a denial of service system crash or might expose sensitive information...

Insufficient Entropy

Overview Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bit...