Side channel timing attacks against (EC)DSA in RSA BSAFE CVE-2019-3739/CVE-2019-3740 - Project Wycheproof is the AFL for Cryptography

About a year ago I wrote this tweet and now I can finally justify it Project Wycheproof https://t.co/wBz9P8atHs is the AFL https://t.co/JM2l557PZi of crypto. Thanks a lot @XorNinja and team notably including Bleichenbacher for providing such a powerful tool — Antonio Sanso @asanso April 9, 2018 i...

RHEL 7 : nss, nss-softokn, nss-util, and nspr (RHSA-2019:2237)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2237 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

nss: Cache side-channel variant of the Bleichenbacher attack

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack and affects all NSS versions prior to NSS 3.41...

Security update for MozillaFirefox (important)

openSUSE Security Update: Security update for MozillaFirefox Announcement ID: openSUSE-SU-2019:1758-1 Rating: important References: 1119069 1120374 1122983 Cross-References: CVE-2018-12404 CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 Affected Products: openSUSE Leap 15.0 An update that fixes four...

SUSE-SU-2019:1351-2 Security update for gnutls

This update for gnutls fixes the following issues: Security issue fixed: - CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS1 v1.5 verification bsc1118087. Non-security issue fixed: - Explicitly require libnettle 3.4.1 to prevent missing symbol errors bsc1134856...

openSUSE: Security Advisory for gnutls (openSUSE-SU-2019:1477-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : gnutls (openSUSE-2019-1477)

This update for gnutls fixes the following issues : Security issue fixed : - CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS1 v1.5 verification bsc1118087. Non-security issue fixed : - Explicitly require libnettle 3.4.1 to prevent missing symbol errors bsc1134856. This upda...

SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2019:1351-1)

This update for gnutls fixes the following issues : Security issue fixed : CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS1 v1.5 verification bsc1118087. Non-security issue fixed: Explicitly require libnettle 3.4.1 to prevent missing symbol errors bsc1134856. Note that...

CVE-2018-12404

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack and affects all NSS versions prior to NSS 3.41...

DEBIAN-CVE-2018-12404

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack and affects all NSS versions prior to NSS 3.41...

ALPINE-CVE-2018-12404

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack and affects all NSS versions prior to NSS 3.41...

CVE-2018-12404

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack and affects all NSS versions prior to NSS 3.41...

OPENSUSE-SU-2019:0183-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: Security issues fixed: - CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack bsc1119069. Non-security issue fixed: - Update to mozilla-nss 3.41.1 This update was imported from the SUSE:SLE-15:Update update project...

Updated gnutls packages fix security vulnerability

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade...

erlang: TLS server vulnerable to Adaptive Chosen Ciphertext attack allowing plaintext recovery or MITM attack

An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA. This may result in plain-text recovery of encrypted messages and/or a man-in-the-middle MiTM attack, despite the attacker not...

[SECURITY] [DLA 1704-1] nss security update

Package : nss Version : 2:3.26-1+debu8u4 CVE ID : CVE-2018-12404 CVE-2018-18508 Debian Bug : 921614 Vulnerabilities have been discovered in nss, the Mozilla Network Security Service library. CVE-2018-12404 Cache side-channel variant of the Bleichenbacher attack CVE-2018-18508 NULL pointer...

Debian DLA-1704-1 : nss security update

Vulnerabilities have been discovered in nss, the Mozilla Network Security Service library. CVE-2018-12404 Cache side-channel variant of the Bleichenbacher attack CVE-2018-18508 NULL pointer dereference in several CMS functions resulting in a denial of service For Debian 8 'Jessie', these problems...

USN-3850-2: NSS vulnerabilities

USN-3850-1 fixed several vulnerabilities in NSS. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack...

openSUSE Security Update : mozilla-nss (openSUSE-2019-183)

This update for mozilla-nss fixes the following issues : Security issues fixed : - CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack bsc1119069. Non-security issue fixed : - Update to mozilla-nss 3.41.1 This update was imported from the SUSE:SLE-15:Update update project...

Security update for mozilla-nss (important)

openSUSE Security Update: Security update for mozilla-nss Announcement ID: openSUSE-SU-2019:0183-1 Rating: important References: 1119069 Cross-References: CVE-2018-12404 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for...