CVE-2022-23408

wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections without AEAD using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c...

CVE-2022-23408

wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections without AEAD using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c...

CVE-2022-23408

CVE-2022-23408 affects wolfSSL 5.x before 5.1.1, where non-random IV values are used in certain situations. The vulnerability arises from misplaced memory initialization in BuildMessage in internal.c, impacting connections that do not use AEAD and rely on AES-CBC or DES3 with TLS 1.1/1.2 or DTLS ...

CVE-2022-23408

wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections without AEAD using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c...

wolfSSL 安全特征问题漏洞

Wolfssl CyaSSL is a small, portable embedded SSL programming library for use by embedded system developers from Wolfssl USA. wolfSSL has a security vulnerability that stems from the use of non-random IV values for x prior to 5.1.1 under certain circumstances. This affects AES-CBC or DES3...

CVE-2022-23408: Use of Insufficiently Random Values

wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections without AEAD using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c...

wolfssl:cryptofuzz-openssl-api: Heap-buffer-overflow in wc_Des_CbcEncrypt

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4747580341354496 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-api Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash...

ASB-A-200041882

In update of kmcompat.cpp, there is a possible loss of potentially sensitive data due to a logic error in the code. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation...

kernel: reassembling encrypted fragments with non-consecutive packet numbers

A vulnerability was found in Linux kernel, where the WiFi implementation reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP...

Apache HTTP Server mod_session_crypto Vulnerability (Dec 2016) - Linux

Apache HTTP Server is prone to a vulnerability in modsessioncrypto. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Python < 2.6.8, 2.7.x < 2.7.3, 3.1.x < 3.1.5, 3.2.x < 3.2.3 'ssl CBC IV attack' (bpo-13885) - Linux

Python is prone to an improper input validation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...

Important: Red Hat Security Advisory: Red Hat 3scale API Management 2.11.0 Release - Container Images

Red Hat 3scale API Management 2.11.0 Release - Container Images A security update for Red Hat 3scale API Management is now available from the Red Hat Container Catalog. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

Security Bulletin: Vulnerabilities in GnuTLS affect Power Hardware Management Console (CVE-2015-8313, CVE-2015-2806 )

Summary GnuTLS is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2015-2806 DESCRIPTION: An unspecified error in libtasn1 related to asn1derdecoding has an unknown impact and attack vector. CVSS Base Score: 6.8 CVSS Temporal...

CyberArk Credential Provider Local Cache Can Be Decrypted

Vulnerability Details Affected Vendor: CyberArk Affected Product: Application Access Manager/Credential Provider Affected Version: Prior to 12.1 Platform: Linux/Windows/zOS CWE Classification: CWE-326: Inadequate Encryption Strength CVE ID: CVE-2021-31798 2. Vulnerability Description CyberArk...

OpenSSL: TLS 1.1 and 1.2 AES-NI Crash (20130205) - Windows

OpenSSL is prone to a denial of service attack. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSL: SSL, TLS and DTLS Plaintext Recovery Attack (20130205) - Windows

OpenSSL is prone to a plaintext-recovery attack. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSL: SSL, TLS and DTLS Plaintext Recovery Attack (20130205) - Linux

OpenSSL is prone to a plaintext-recovery attack. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSL: Invalid TLS/DTLS Record Attack (20120510) - Linux

OpenSSL is prone to a buffer underflow vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSL: Invalid TLS/DTLS Record Attack (20120510) - Windows

OpenSSL is prone to a buffer underflow vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSL: Timing-based attacks on SSL/TLS with CBC encryption (CVE-2003-0078) - Windows

OpenSSL is prone to timing-based attacks on SSL/TLS with CBC encryption. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...