Uncaught Exception

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: Large handshake records may cause panics in crypto/tls.Both clients and servers may send large TLS handshake records which cause...

SUSE CVE-2015-8618

The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors...

SUSE CVE-2017-0379

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c...

SUSE CVE-2018-1000613

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in XMSS/XMSS^MT private key deserialization that can result in...

SUSE CVE-2020-25659

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS1 v1.5 ciphertext...

Double free after calling PEM_read_bio_ex

...

GHSA-W7PP-M8WF-VJ6R Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf

Previously, Cipher.updateinto would accept Python objects which implement the buffer protocol, but provide only immutable buffers: pycon outbuf = b"\x00" 32 c = ciphers.CipherAESb"\x00" 32, modes.ECB.encryptor c.updateintob"\x00" 16, outbuf 16 outbuf...

cryptography 代码问题漏洞

python-cryptography is a Python code library for cryptographic applications from the Cryptographic team. A code issue vulnerability exists in cryptography. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

CVE-2021-26407

A randomly generated Initialization Vector IV may lead to a collision of IVs with the same key potentially resulting in information disclosure...

openssl security update

An update is available for openssl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transpo...

AZL-43341 CVE-2021-43565 affecting package cri-o for versions less than 1.22.3-5

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...

golang: crypto/elliptic: IsOnCurve returns true for invalid field elements

A flaw was found in the elliptic package of the crypto library in golang when the IsOnCurve function could return true for invalid field elements. This flaw allows an attacker to take advantage of this undefined behavior, affecting the availability and integrity of the resource...

golang: crypto/elliptic: panic caused by oversized scalar

An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to use a crafted scaler input longer than 32 bytes, causing P256.ScalarMult or P256.ScalarBaseMult to panic, leading to a loss of availability...

Western Digital Sweet B 安全漏洞

Western Digital Sweet B is a library from Western Digital, Inc. that implements public key elliptic curve cryptography ECC using NIST P-256 and SECG secp256k1 curves. A security vulnerability exists in the Western Digital Sweet B library that stems from the fact that when a shared key or dot...

GHSA-Q3CJ-2R34-2CWC Improper input validation in cryptography

HKDF in cryptography before 1.5.3 returns an empty byte-string if used with a length less than algorithm.digestsize...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CLSA-2022-1647550273 Fix of CVE: CVE-2022-0778

CVE-2022-0778: Fix possible infinite loop in BNmodsqrt...

CVE-2022-0778 Infinite loop in BN_mod_sqrt() reachable when parsing certificates

The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a...

PT-2022-6958

Name of the Vulnerable Software and Affected Versions golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go golang.org/x/crypto/ssh versions through 1.16.15 golang.org/x/crypto/ssh versions 1.17.x through 1.17.8 Description The issue is related to the use of defective...