openssh security, bug fix, and enhancement update

8.0p1-3 + 0.10.3-7 - Fix typos in manual pages 1668325 - Use the upstream support for PKCS8 PEM files alongside with the legacy PEM files 1712436 - Unbreak ssh-keygen -A in FIPS mode 1732424 - Add missing RSA certificate types to offered hostkey types in FIPS mode 1732449 8.0p1-2 + 0.10.3-7 - All...

Dell RSA BSAFE Micro Edition Suite and RSA BSAFE Crypto-C Micro Edition Information Disclosure Vulnerabilities

The Dell RSA BSAFE Micro Edition Suite and the RSA BSAFE Crypto-C Micro Edition are both encryption toolkits from Dell USA. An information disclosure vulnerability exists in Dell RSA BSAFE Crypto-C Micro Edition and Dell RSA BSAFE Micro Edition Suite. The vulnerability stems from errors such as...

Dell RSA BSAFE Micro Edition Suite and RSA BSAFE Crypto-C Micro Edition Buffer Overflow Vulnerabilities

The Dell RSA BSAFE Micro Edition Suite and the RSA BSAFE Crypto-C Micro Edition are both encryption toolkits from Dell USA. A buffer overflow vulnerability exists in Dell RSA BSAFE Crypto-C Micro Edition and RSA BSAFE Micro Edition Suite. The vulnerability originates when a networked system or...

UBUNTU-CVE-2019-18808

A memory leak in the ccprunshacmd function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service memory consumption, aka CID-128c66429247...

CVE-2019-2323

Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640,...

Code injection

Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640,...

CVE-2019-2323

Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640,...

Information Disclosure

kernel is vulnerable to Information Disclosure. It can happen because it does not fully initialize structures that are copied to userspace in the function cryptoreportone in crypto/cryptouser.c...

kernel: Information Disclosure in crypto_report_one in crypto/crypto_user.c

An issue was discovered in the Linux kernel in the cryptoreportone and related functions in the crypto/cryptouser.c the crypto user configuration API which do not fully initialize structures that are copied to userspace, potentially leaking sensitive kernel memory content to a userspace...

JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle...

Calculating the Benefits of the Advanced Encryption Standard

NIST has completed a study -- it was published last year, but I just saw it recently -- calculating the costs and benefits of the Advanced Encryption Standard. From the conclusion: The result of performing that operation on the series of cumulated benefits extrapolated for the 169 survey...

GHSA-2MH8-GX2M-MR75 Out-of-Memory Error in Bouncy Castle Crypto

The ASN.1 parser in Bouncy Castle Crypto aka BC Java 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64...

Out-of-Memory Error in Bouncy Castle Crypto

The ASN.1 parser in Bouncy Castle Crypto aka BC Java 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64...

JSS CryptoManager Trust Management Issues Vulnerability

JSS CryptoManager is a JSS Java Network Security Service cryptographic management package. A trust management issue vulnerability exists in the implementation of the 'Leaf and Chain' OCSP protocol in JSS CryptoManager versions 4.4.6 onwards, 4.5.3 onwards, and 4.6.0 onwards, which can be exploite...

PT-2019-5267 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.3.9 Description: The issue is related to a memory leak in the crypto reportstat function, which can lead to a denial of service due to memory consumption. This can be triggered by causing copy from user...

CVE-2019-17359

The ASN.1 parser in Bouncy Castle Crypto aka BC Java 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64...

CVE-2019-17359

The ASN.1 parser in Bouncy Castle Crypto aka BC Java 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64...

Memory corruption

The ASN.1 parser in Bouncy Castle Crypto aka BC Java 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64...

CVE-2019-17359

The ASN.1 parser in Bouncy Castle Crypto aka BC Java 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64...

CVE-2019-17359

The CVE-2019-17359 entry concerns Bouncy Castle Crypto (BC Java) 1.63. The vulnerability lies in the ASN.1 parser, which can trigger a large memory allocation leading to a memory exhaustion/OutOfMemoryError via crafted ASN.1 data. Affected product: BC Java 1.63; fixed in BC Java 1.64. The issue i...