248 matches found
Insufficient Entropy
Overview Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bit...
OESA-2023-1441 cjose security update
Implementation of JOSE for C/C++ Security Fixes: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of...
OpenJDK: weakness in AES implementation (8308682)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2;...
OpenJDK: weakness in AES implementation (8308682)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2;...
AZL-36936 CVE-2023-37464 affecting package cjose for versions less than 0.6.2.2-7
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug...
UBUNTU-CVE-2023-37464
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug...
DEBIAN-CVE-2023-2975
Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...
openssl: Input buffer over-read in AES-XTS implementation on 64 bit ARM
A vulnerability was found in OpenSSL. This security flaw occurs because the AES-XTS cipher decryption implementation for the 64-bit ARM platform contains an issue that could cause it to read past the input buffer, leading to a crash...
kernel: crypto: qat - fix out-of-bounds read
An out-of-bounds read vulnerability was found in the Linux kernel's Intel QAT QuickAssist Technology crypto driver. When preparing an AES-CTR encryption request on QAT GEN4 devices, the driver rounds up the key size by 16 bytes before copying. If this rounding occurs before the memcpy operation,...
Input buffer over-read in AES-XTS implementation on 64 bit ARM
...
New Strain of Rorschach Ransomware Targeting US- Firms
By Deeba Ahmed Rorschach ransomware boasts advanced encryption technology and can spread automatically on the machine if executed on a domain controller. This is a post from HackRead.com Read the original post: New Strain of Rorschach Ransomware Targeting US- Firms...
CVE-2023-26084
The armv8decaesgcmfull API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data, leading to a man-in-the-middle attack. This occurs because of an improperly initialized variable...
AArch64cryptolib 路径遍历漏洞
AArch64cryptolib is an open source scratch implementation of a cryptographic primitive by Arm Software. A path traversal vulnerability exists in versions prior to AArch64cryptolib 20230220, which stems from the inability of the armv8decaesgcmfull API to validate authentication tags for AES-GCM...
PT-2023-20477 · Arm · Arm Aarch64Cryptolib
Name of the Vulnerable Software and Affected Versions: Arm AArch64cryptolib versions before 86065c6 Description: The issue concerns the armv8 dec aes gcm full API, which fails to verify the authentication tag of AES-GCM protected data. This failure is due to an improperly initialized variable,...
SUSE CVE-2010-3074
SSLCipher.cpp in EncFS before 1.7.0 uses an improper combination of an AES cipher and a CBC cipher mode for encrypted filesystems, which allows local users to obtain sensitive information via a watermark attack...
SUSE CVE-2016-7440
The C software implementation of AES Encryption and Decryption in wolfSSL formerly CyaSSL before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences...
PT-2023-15648 · Arm · Armv8
Name of the Vulnerable Software and Affected Versions: ARMv8 affected versions not specified Description: The AES instructions on the ARMv8 platform do not have an algorithm that is intrinsically resistant to side-channel attacks. The vendor notes that while power side channel attacks are possibl...
CVE-2022-37710
Patterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: 1 keybackup.data License Encryption Key or 2 Eaglesoft.Server.Configuration.data DbEncryptKeyPrimary Encryption Key. Applicable files are encrypted with keys and salt that are hardcoded into a DLL or...
Juiker 信任管理问题漏洞
Juiker is an instant messaging software for government and business organizations from Juiker. Juiker suffers from a security vulnerability that stems from the application's use of hard-coded AES keys in the source code. A physical attacker with root access to Android could use the AES key to...