5586 matches found
Critical Photon OS Security Update - PHSA-2023-3.0-0681
Updates of 'python-cryptography', 'coredns', 'grub2' packages of Photon OS have been released...
The vulnerability of the software for remote IT support and monitoring of Dell Secure Connect Gateway (SCG) arises from the use of cryptographic algorithms that contain defects. This allows attackers to gain unauthorized access to protected information.
The vulnerability of software for remote IT support and monitoring of Dell Secure Connect Gateway SCG is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected...
Starting your journey to become quantum-safe
There’s no doubt we are living through a time of rapid technological change. Advances in ubiquitous computing and ambient intelligence transform nearly every aspect of work and life. As the world moves forward with new advancements and distributed technologies, so too does the need to understand...
Starting your journey to become quantum-safe
There’s no doubt we are living through a time of rapid technological change. Advances in ubiquitous computing and ambient intelligence transform nearly every aspect of work and life. As the world moves forward with new advancements and distributed technologies, so too does the need to understand...
CVE-2023-46129
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server...
PT-2023-8438 · Ibm · Ibm Db2
Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server version 11.5 Description: The issue is related to the use of defective cryptographic algorithms, which can allow a remote attacker to gain unauthorized access to protected...
PT-2023-29922 · Quic-Go · Quic-Go
Name of the Vulnerable Software and Affected Versions: quic-go versions 0.37.0 through 0.37.2 Description: The issue arises from serializing an ACK frame after the CRYPTO frame, allowing a node to complete the handshake. This can trigger a nil pointer dereference when the node attempts to drop th...
[SECURITY] [DLA 3634-1] nss security update
Debian LTS Advisory DLA-3634-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton October 28, 2023 https://wiki.debian.org/LTS Package : nss Version : 2:3.42.1-1+deb10u7 CVE ID : CVE-2020-25648 CVE-2023-4421 Multiple vulnerabilities were found in nss, a set of libraries...
DEBIAN-CVE-2023-46233
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm...
CVE-2023-46133 crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a...
CVE-2023-46133
CVE-2023-46133 documents a weakness in CryptoES prior to v2.1.0 where PBKDF2 was configured by default to use SHA-1 with a single iteration (1,000), making it far weaker than the 1993 specification and current standards. This can impact password protection and digital signatures. A patch is avail...
CVE-2023-46133 crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a...
GHSA-7G24-QG88-P43Q jose4j uses weak cryptographic algorithm
jose4j before v0.9.3 allows attackers to set a low PBES2 iteration count of 1000 or less...
python39:3.9 and python39-devel:3.9 security update
Cython 0.29.21-5 - Convert from Fedora to the python39 module in RHEL8 - Resolves: rhbz1877430 modwsgi 4.7.1-5 - Core dumped upon file upload = 1GB Resolves: rhbz2125172 numpy 1.19.4-3 - Adjusted the postun scriptlets to enable upgrading to RHEL 9 - Resolves: rhbz1933055 pybind11 2.7.1-1 - Update...
afETH.withdrawTime() still returns an invalid withdrawTime.
See the markdown file with the details of this report here. --- The text was updated successfully, but these errors were encountered: All reactions...
Why We Don’t Generate Elliptic Curves Every Day
With all the talk recently of how the NIST curve parameters were selected, a reasonable observer could wonder why we all use the same curves instead of generating them along with keys, like we do for Diffie-Hellman parameters. You might have memories of waiting around for openssl dhparam to run a...
The vulnerability of implementations of standards PKCS#1 v1.5, OAEP, and RASASVP in the NSS (Network Security Services) library allows a attacker to execute the Bleichenbacher attack or the Marvin attack.
The vulnerability of implementations of standards PKCS1 v1.5, OAEP, and RASASVP in the NSS Network Security Services library set is related to insufficient protection of service data due to timing discrepancies. Exploiting this vulnerability allows a remote attacker to execute the Bleichenbacher...
golang: crypto/tls: slow verification of certificate chains containing large RSA keys
A denial of service vulnerability was found in the Golang Go package caused by an uncontrolled resource consumption flaw. By persuading a victim to use a specially crafted certificate with large RSA keys, a remote attacker can cause a client/server to expend significant CPU time verifying...
CVE-2022-26942
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment TEE modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure superviso...