Debian DLA-2986-1 : golang-1.8 - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2986 advisory. - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. CVE-2022-23772 -...

[Security Nation] Whitney Merrill on the Crypto & Privacy Village (and the Latest in Data Privacy)

!\Security Nation\ Whitney Merrill on the Crypto & Privacy Village \and the Latest in Data Privacy\https://blog.rapid7.com/content/images/2022/04/securitynationlogo-1.jpg In this episode of Security Nation, Jen and Tod chat with Whitney Merrill, Data Protection Officer at Asana, about her work on...

SUSE SLED15 / SLES15 Security Update : go1.17 (SUSE-SU-2022:1411-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1411-1 advisory. - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of...

GO-2021-0356 Denial of service via crafted Signer in golang.org/x/crypto/ssh

Attackers can cause a crash in SSH servers when the server has been configured by passing a Signer to ServerConfig.AddHostKey such that 1 the Signer passed to AddHostKey does not implement AlgorithmSigner, and 2 the Signer passed to AddHostKey returns a key of type “ssh-rsa” from its PublicKey...

EulerOS 2.0 SP8 : golang (EulerOS-SA-2022-1566)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header falsely designating that many files are present can cause ...

GSD-2022-1002116 crypto: ccree - Fix use after free in cc_cipher_exit()

crypto: ccree - Fix use after free in cccipherexit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.110 by commit...

GSD-2022-1001897 crypto: hisilicon/sec - fix the aead software fallback for engine

crypto: hisilicon/sec - fix the aead software fallback for engine This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

GSD-2022-1001896 crypto: octeontx2 - remove CONFIG_DM_CRYPT check

crypto: octeontx2 - remove CONFIGDMCRYPT check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

GSD-2022-1001894 crypto: ccp - Ensure psp_ret is always init'd in __sev_platform_init_locked()

crypto: ccp - Ensure pspret is always init'd in sevplatforminitlocked This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

GSD-2022-1001891 crypto: ccree - Fix use after free in cc_cipher_exit()

crypto: ccree - Fix use after free in cccipherexit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

GSD-2022-1001589 crypto: octeontx2 - remove CONFIG_DM_CRYPT check

crypto: octeontx2 - remove CONFIGDMCRYPT check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001587 crypto: ccp - Ensure psp_ret is always init'd in __sev_platform_init_locked()

crypto: ccp - Ensure pspret is always init'd in sevplatforminitlocked This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001585 crypto: hisilicon/sec - fix the aead software fallback for engine

crypto: hisilicon/sec - fix the aead software fallback for engine This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001581 crypto: ccree - Fix use after free in cc_cipher_exit()

crypto: ccree - Fix use after free in cccipherexit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001283 crypto: octeontx2 - remove CONFIG_DM_CRYPT check

crypto: octeontx2 - remove CONFIGDMCRYPT check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

GSD-2022-1001280 crypto: ccp - Ensure psp_ret is always init'd in __sev_platform_init_locked()

crypto: ccp - Ensure pspret is always init'd in sevplatforminitlocked This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

GSD-2022-1001275 crypto: ccree - Fix use after free in cc_cipher_exit()

crypto: ccree - Fix use after free in cccipherexit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

Watch Out! Cryptocurrency Miners Targeting Dockers, AWS and Alibaba Cloud

LemonDuck, a cross-platform cryptocurrency mining botnet, is targeting Docker to mine cryptocurrency on Linux systems as part of an active malware campaign. "It runs an anonymous mining operation by the use of proxy pools, which hide the wallet addresses," CrowdStrike said in a new report. "It...

Fedora: Security Advisory for golang-x-crypto (FEDORA-2022-a4c9009f3e)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-x-crypto (FEDORA-2022-d37fb34309)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...