Memory Leakage

go-crypto-winnative is vulnerable to a Memory Leakage. The vulnerability is due to improper resource management due to failure to release the key handle in cng.TLS1PRF, causing a small memory leak on each call...

CVE-2025-25199

go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41...

Malicious code in crypto-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a037816e38bab1c99484a360227650688ef0859f5e52d151d3b2c87a0865535 Any computer that has this package install...

MAL-2025-1319 Malicious code in crypto-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a037816e38bab1c99484a360227650688ef0859f5e52d151d3b2c87a0865535 Any computer that has this package install...

MAL-2025-1317 Malicious code in crypto-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bed52b1811db7c40f9bfbc1e7e15add32d6e51e3ec04d0bf81faf038a5a1c88 Any computer that has this package install...

Malicious code in crypto-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bed52b1811db7c40f9bfbc1e7e15add32d6e51e3ec04d0bf81faf038a5a1c88 Any computer that has this package install...

MAL-2025-1318 Malicious code in crypto-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03333e75c4b6ad776d7e7e5242030adf8dc36c5a4df0f10802c33bff345516d6 Any computer that has this package install...

go-crypto-winnative BCryptGenerateSymmetricKey memory leak

Calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time...

CVE-2025-25199

go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41...

AZL-79122 CVE-2025-25199 affecting package golang 1.25.7-1

go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41...

CVE-2025-25199 BCryptGenerateSymmetricKey memory leak

go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41...

CVE-2025-25199 BCryptGenerateSymmetricKey memory leak

go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41...

CVE-2025-25199 BCryptGenerateSymmetricKey memory leak

go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41...

CVE-2025-25199

CVE-2025-25199 concerns the go-crypto-winnative Go crypto backend for Windows (CNG). Root cause: prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF did not release the key handle, causing a small memory leak per use. The fix is included in the Microsoft Go builds of ve...

The vulnerability of the ParsePKCS1PrivateKey function in the crypto/x509 library for the Go programming language allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the ParsePKCS1PrivateKey function in the crypto/x509 library for the Go programming language is related to incorrect processing of syntactically incorrect structures. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to...

SUSE SLED15: crypto-policies / crypto-policies-scripts / krb5 / krb5-32bit / etc (SUSE-SU-2025:0401-1)

"The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0401-1 advisory. Security issue fixed: - CVE-2025-24528: Fixed out-of-bounds write caused by overflow when calculating ul...

Microsoft go-crypto-winnative 安全漏洞

Microsoft go-crypto-winnative is a library from Microsoft Corporation USA. A security vulnerability exists in go-crypto-winnative, which stems from a call to cng.TLS1PRF that does not release the key handle, creating a small memory leak each time...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: crypto: hisilicon/debugfs – Fixed the issue with the uninit process of debugfs. During the zip probe process, a failure in debugfs does not stop the probe. When the initialization of debugfs fails, jumping to the error branch...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm – injects an error before stopping the queue. The master OOO cannot be completely closed when the accelerator core reports a memory error. Therefore, the driver needs to inject the qm error to close the maste...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: bcm – add an error check in the ahashhmacinit function The ahashinit functions may return errors. The ahashhmacinit function should not return ok when ahashinit returns an error. For example, ahashinit might return -ENOME...