OpenSSL 3.0.0 < 3.0.10 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.0.10. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.10 advisory. - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functio...

SUSE CVE-2023-2975

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

MAL-2023-1434 Malicious code in systemd-daemon (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84420cf94f4b56e0aa3cb3e0fa23b2aea98b1bcf47692360e7a3b9578e92b3f3 Source: ossf-package-analysis 41aacbd733d26afad7933e31f87d51fa0d748969082bd229cc90b3bdbf2d7b9b The OpenSSF Package Analysis project identified...

OpenSSL Information Disclosure Vulnerability (20230714) - Linux

OpenSSL is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl";...

FreeBSD : OpenSSL -- AES-SIV implementation ignores empty associated data entries (41c60e16-2405-11ee-a0d1-84a93843eb75)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 41c60e16-2405-11ee-a0d1-84a93843eb75 advisory. - Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty...

AZL-47652 CVE-2023-2975 affecting package hvloader for versions less than 1.0.1-6

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

DEBIAN-CVE-2023-2975

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

ALPINE-CVE-2023-2975

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

UBUNTU-CVE-2023-2975

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

CVE-2023-2975 AES-SIV implementation ignores empty associated data entries

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

CVE-2023-2975 AES-SIV implementation ignores empty associated data entries

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

CVE-2023-2975

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

OpenSSL 授权问题漏洞

OpenSSL is an open source capable general-purpose cryptographic library from the OpenSSL team that implements the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. It supports a variety of cryptographic algorithms, including symmetric ciphers, hashing algorithms, secure...

PT-2023-4553 · Openssl +7 · Openssl +7

Name of the Vulnerable Software and Affected Versions: OpenSSL affected versions not specified Description: The AES-SIV cipher implementation in OpenSSL contains a bug that causes it to ignore empty associated data entries, which are unauthenticated as a consequence. This issue can mislead...

MAL-2023-1220 Malicious code in js-starter-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac64c737affe45fd76d9899026d4a4d2f775e04e0391693ffcb2dafa665b07c5 The OpenSSF Package Analysis project identified 'js-starter-code' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-589 Malicious code in mesos-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ca86e4f7655ee05071ef73a17f239df8dcc483b932ef71d351cf47e8435376b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Handle-Ripper - Windows Handle Hijacker

Handle hijacking is a technique used in Windows operating systems to gain access to resources and resources of a system without permission. It is a type of privilege escalation attack in which a malicious user takes control of an object handle, which is an identifier that is used to reference a...

MAL-2023-538 Malicious code in jquery.select2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6dd7d61b3b3371967b1ec5a01455d7ec3bd6dc3372a8e399b6696c388394419 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1116 Malicious code in application-delivery-tool-preload-expo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 56e4071882ebfaf078f45ca400f352aa4473aab57faa966a208f00a8ef67dfd4 The OpenSSF Package Analysis project identified 'application-delivery-tool-preload-expo' @ 3.0.0 npm as malicious. It is considered malicious...

MAL-2023-1349 Malicious code in yelp-js-error-reporting-init-error-reporting (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b0ef31127203cf701c7aa890cdebf10454c53c989cb98015927e9b62881c7bf6 The OpenSSF Package Analysis project identified 'yelp-js-error-reporting-init-error-reporting' @ 19.20.20 npm as malicious. It is considered...