1022 matches found
UBUNTU-CVE-2019-14318
Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar multiplication in ecp.cpp...
Amazon Linux 2 : java-11-amazon-corretto (ALAS-2019-1246)
OpenJDK: Insufficient restriction of privileges in AccessController Security, 8216381 CVE-2019-2786 OpenJDK: Unbounded memory allocation during deserialization in Collections Utilities, 8213432 CVE-2019-2769 libpng: pngimagefree in png.c in libpng has a use-after-free because pngimagefreefunction...
RHEL 7 : java-11-openjdk (RHSA-2019:1810)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1810 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...
OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344)
Vulnerability in the Java SE component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...
SIAM Conference on Applied Algebraic Geometry 2019 - Isogenies mini-symposium
So here we are in the nice city of Bern, in the Teutonic Switzerland, for SIAM Conference on Applied Algebraic Geometry 2019 that this year counts more than 750 attendees! The weather is warm enough but the isogenies topic has never been so hot! So for this occurrence of the conference Tanja Lang...
Information Disclosure Through Timing Attack
actionpack and activesupport is vulnerable to information disclosure. The vulnerability exists as timing attack was possible through the lack of constant time string comparison made for the message digest, causing information disclosure...
GHSA-C35V-QWQG-87JC express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison
Versions of express-basic-auth prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the...
Timing Attack
jenkins is vulnerable to timing attack. A remote attacker is able to determine API tokens through a brute-force approach of analyzing server response time to guess the value of the API tokens. This is due to the verification of the API tokens not being performed using a constant-time algorithm...
Timing Attack
jenkins is vulnerable to timing attack. A remote attacker is able to bypass CSRF protection mechanism through a brute-force approach of analyzing server response time to guess the value of CSRF tokens. This is due to the verification of the CSRF tokens not being performed using a constant-time...
Timing Attack
SimpleCrypto.Net is vulnerable to timing attack. A non-constant time comparison function used to compare passwords allow remote attackers to determine valid passwords by analyzing the server response time...
Moderate severity vulnerability that affects actionpack
Withdrawn, accidental duplicate publish. The httpbasicauthenticatewith method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and...
Security Bulletin: Vulnerabilities in OpenSSL affect IBM Tealeaf Customer Experience
Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM Tealeaf Customer Experience. IBM Tealeaf Customer Experience has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6304 DESCRIPTION: OpenSSL is vulnerable ...
Monero: Constant-time comparison is not always implemented; critical areas are vulnerable to key-timing attacks
In my most superficial of reviews, constant-time comparison appears to not be globally implemented at a glance, only implemented within the ref10 implementation. With that said, the following areas either appear to be vulnerable, or are potentially vulnerable, to key-timing attacks: 1. Containers...
Intel Integrated Performance Primitives Cryptography Library Information Disclosure Vulnerability
Intel Integrated Performance Primitives Cryptography Library is a multi-threaded library for multimedia and data processing applications from Intel Corporation. A security vulnerability exists in certain implementations of the Intel Integrated Performance Primitives Cryptography Library versions...
CVE-2018-3691
Some implementations in Intel Integrated Performance Primitives Cryptography Library before version 2018 U3.1 do not properly ensure constant execution time...
Intel Integrated Performance Primitives Cryptography Library Information Disclosure Vulnerability
Intel Integrated Performance Primitives Cryptography Library is a multi-threaded library for multimedia and data processing applications from Intel Corporation. A security vulnerability exists in Intel Integrated Performance Primitives Cryptography Library versions prior to 2018 U2.1, which stems...
CVE-2017-2585
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks...
CVE-2017-2585
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks...
Icinga Password Disclosure Vulnerability
Icinga is an open source computer system and network monitoring application. Icinga suffers from a password disclosure vulnerability. The vulnerability arises due to the lack of a constant time password comparison feature. An attacker can exploit this vulnerability to obtain a password...