OpenSSL BoringSSL Code Execution

The vulnerability of the Montgomery modular multiplication function with a constant time cost in the OpenSSL and BoringSSL libraries relates to the possibility of writing data beyond the buffer boundaries into memory. Exploiting this vulnerability allows an attacker to execute arbitrary code by...

GSD-2022-1004006 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.282 by commit...

GSD-2022-1003915 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.246 by commit...

GSD-2022-1003782 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.197 by commit...

GSD-2022-1003646 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.120 by commit...

GSD-2022-1003431 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.45 by commit...

GSD-2022-1003165 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.13 by commit...

GSD-2022-1002851 dm crypt: make printing of the key constant-time

dm crypt: make printing of the key constant-time This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.2 by commit...

GSD-2022-1002526 heap buffer overflow in OpenSSL version 3.0.4

In OpenSSL version 3.0.4 a heap buffer overflow exists in the AVX512 support that can be attacked via network resulting in code execution. This is reachable via four code paths: RSAZ 1024, RSAZ 512, Dual 1024 RSAZ, and Default constant-time Montgomery modular exponentiation. Please note this issu...

PT-2022-31909

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.120 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

PT-2022-31114

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.2 Description The issue concerns the dm crypt feature in the Linux Kernel, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual...

PT-2022-32178

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.246 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

PT-2022-31428

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.13 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time, potentially leading to security vulnerabilities. The actual impact and attack plausibility have no...

PT-2022-32045

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.197 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

PT-2022-32269

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.282 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

PT-2022-31694

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.45 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time, potentially leading to security vulnerabilities. The actual impact and attack plausibility have no...

PT-2022-32351

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.317 Description The issue concerns the dm crypt feature, where the printing of the key is not constant-time. This could potentially lead to security vulnerabilities, although the actual impact and attack...

Possible DoS in Staking.claim() function

Lines of code Vulnerability details Impact In Staking contract, users are allowed to stake for another recipient. And it also updates warmUpInfo.expiry for recipient address so recipient can only claim after this new expiry is passed. Attackers can abuse this to constantly stake 1 wei for another...

Malicious code in constant-unifi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e52978a6cedcbd4f12d4e0ad230a7b6294a81f1f2f17fd929d4be5793ca3235 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2165 Malicious code in constant-unifi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e52978a6cedcbd4f12d4e0ad230a7b6294a81f1f2f17fd929d4be5793ca3235 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...