3024 matches found
SUSE-SU-2023:4190-1 Security update for openssl-3
This update for openssl-3 fixes the following issues: - CVE-2023-5363: Incorrect cipher key and IV length processing. bsc1216163 - CVE-2023-3817: Add test of DHcheck with q = p + 1. bsc1213853...
SUSE-SU-2023:4189-1 Security update for openssl-3
This update for openssl-3 fixes the following issues: - CVE-2023-5363: Incorrect cipher key and IV length processing. bsc1216163 - CVE-2023-3817: Add test of DHcheck with q = p + 1. bsc1213853...
OpenSSL 3.0.0 < 3.0.12 Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 3.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.12 advisory. - Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of...
OpenSSL Incorrect Cipher Key & IV Length Processing Vulnerability (20231024) - Windows
OpenSSL is prone to an incorrect processing of key and initialisation vector IV lengths vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Debian: Security Advisory (DSA-5532-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 5532-1] openssl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5532-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 24, 2023 https://www.debian.org/security/faq -...
USN-6450-1: OpenSSL vulnerabilities
Tony Battersby discovered that OpenSSL incorrectly handled key and initialization vector IV lengths. This could lead to truncation issues and result in loss of confidentiality for some symmetric cipher modes. CVE-2023-5363 Juerg Wullschleger discovered that OpenSSL incorrectly handled the AES-SIV...
CVE-2023-5363 Incorrect cipher key & IV length processing
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
CVE-2023-5363 Incorrect cipher key & IV length processing
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
CVE-2023-5363 Incorrect cipher key & IV length processing
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
Missing Cryptographic Step
Overview openssl is a package that wraps the OpenSSL library. Affected versions of this package are vulnerable to Missing Cryptographic Step when the EVPEncryptInitex2, EVPDecryptInitex2 or EVPCipherInitex2 functions are used. An attacker can cause truncation or overreading of key and...
UBUNTU-CVE-2023-5363
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
Ubuntu 22.04 LTS / 23.04 / 23.10 : OpenSSL vulnerabilities (USN-6450-1)
The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6450-1 advisory. Tony Battersby discovered that OpenSSL incorrectly handled key and initialization vector IV lengths. This could lead to truncation issues...
PT-2023-6818
Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0 and 3.1 Description A bug has been identified in the processing of key and initialisation vector IV lengths, potentially leading to truncation or overruns during the initialisation of some symmetric ciphers. This issue can...
CVE-2022-24404
Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion...
Texas Instruments OMAP L138 Security Vulnerability
The Texas Instruments OMAP L138 is a DSP+ARM industrial processor from Texas Instruments. A security vulnerability exists in the Texas Instruments OMAP L138 secure variants, which stems from the ES implementation being susceptible to a timing side-channel, which can be exploited by an attacker to...
TETRA BURST Security Vulnerability
TETRA BURST is a terrestrial trunked radio standard for radio communications from TETRA BURST. A security vulnerability exists in TETRA BURST that stems from a flaw in the authentication algorithm, which can be exploited by an attacker to set the derived cipher DCK to 0. The vulnerability is caus...
PT-2023-5882 · Mbed Tls +3 · Mbed Tls +3
Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 2.x before 2.28.5 Mbed TLS versions 3.x before 3.5.0 Description: The issue is related to errors in handling encryption in DTLS connections, specifically when using zero encryption or RC4 cipher. This can allow a remote...
[SECURITY] Fedora 38 Update: rust-aes-gcm-0.10.3-1.fc38
Pure Rust implementation of the AES-GCM Galois/Counter Mode Authenticated Encryption with Associated Data AEAD Cipher with optional architecture-specific hardware acceleration...
[SECURITY] Fedora 37 Update: rust-aes-gcm-0.10.3-1.fc37
Pure Rust implementation of the AES-GCM Galois/Counter Mode Authenticated Encryption with Associated Data AEAD Cipher with optional architecture-specific hardware acceleration...