python-cryptography: memory corruption via immutable objects

A vulnerability was found in python-cryptography. In affected versions, Cipher.updateinto would accept Python objects which implement the buffer protocol but provide only immutable buffers. This issue allows immutable objects such as bytes to be mutated, thus violating the fundamental rules of...

CISA, NSA, and NIST Publish Factsheet on Quantum Readiness

Today, the Cybersecurity and Infrastructure Security Agency CISA, National Security Agency NSA and National Institute of Standards and Technology NIST released a joint factsheet, Quantum-Readiness: Migration to Post-Quantum Cryptography PQC, to inform organizations—especially those that support...

[SECURITY] Fedora 38 Update: libreswan-4.12-1.fc38

Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...

[SECURITY] Fedora 37 Update: libreswan-4.12-1.fc37

Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...

CVE-2023-39908

The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory...

CVE-2023-38325

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options...

Weak Cryptography

github.com/supranational/blst is vulnerable to Weak Cryptography. The vulnerability exists due to logic errors in SigValidate function which results in group-check omission...

CLSA-2023-1691576279 Fix CVE(s): CVE-2023-38408

SECURITY UPDATE: helper programs can dlopen/dlclose any libraries from /usr/lib - debian/patches/CVE-2023-38408-Ensure-FIDO-PKCS11-libraries-contain-expect.patch: checks libraries before dlopen - debian/patches/CVE-2023-38408-Separate-ssh-pkcs11-helpers-for-each-p11-mo.patch: separate...

Lindell17 TSS Injection Vulnerability

tss-lib is an open source IO FinNet implementation of the multi-party t,n- threshold ECDSA Elliptic Curve Digital Signature Algorithm based on Gennaro and Goldfeder 20201 and EdDSA Edwards Curve Digital Signature Algorithm. A security vulnerability exists in Lindell17 TSS that stems from allowing...

PT-2023-18919 · Hcl · Hcl Dryice Iautomate

Name of the Vulnerable Software and Affected Versions: HCL DRYiCE iAutomate affected versions not specified Description: The issue is related to the use of a broken cryptographic algorithm, which can potentially allow an attacker to compromise the confidentiality and integrity of sensitive...

CVE-2023-39533

CVE-2023-39533 affects the Go libp2p core/crypto implementation (Noise handshake and x509 verification) where malicious peers can force a resource exhaustion by using large RSA keys. The issue is mitigated by restricting RSA keys to

You Can’t Rush Post-Quantum-Computing Cryptography Standards

I just read an article complaining that NIST is taking too long in finalizing its post-quantum-computing cryptography standards. This process has been going on since 2016, and since that time there has been a huge increase in quantum technology and an equally large increase in quantum understandi...

nodejs: DiffieHellman do not generate keys after setting a private key

A vulnerability has been identified in the Node.js, where a generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet...

The vulnerability of the Data Transfer Security function in software for creating and managing graphical interfaces for control panels in GT Designer3, GOT2000 Series, GOT SIMPLE Series, GT SoftGOT2000, allows a perpetrator to gain unauthorized access to protected information and enhance their privileges.

The vulnerability of the Data Transfer Security function in software for creating and managing graphical interfaces for control panels in GT Designer3, GOT2000 Series, GOT SIMPLE Series, and GT SoftGOT2000 is related to weak cryptography for passwords. Exploiting this vulnerability can allow...

CVE-2023-3180

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtiocryptohandlesymreq. There is no check for the value of srclen and dstlen in virtiocryptosymophelper, potentially leading to a heap buffer overflow when the two values differ...

Dependency On Vulnerable Third-Party Component

cryptography contains a Dependency On a Vulnerable Third-Party Component. The use of the bundled OpenSSL component which contains several security issues which allows an attacker to disrupt secure operations in the library. Only users installing from wheels built by the cryptography pip library a...

PT-2023-4152 · Mitsubishi · Gt Softgot2000 +3

Name of the Vulnerable Software and Affected Versions: GT Designer3 versions affected versions not specified GOT2000 Series versions affected versions not specified GOT SIMPLE Series versions affected versions not specified GT SoftGOT2000 versions affected versions not specified Description: The...

AZL-37344 CVE-2023-29409 affecting package golang for versions less than 1.21.6-1

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three...

Moxa EDR-810 Web Server Weak Cryptography for Passwords (CVE-2017-12129)

An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could intercept weakly encrypted passwords and could brute force them. This plugin only works with Tenable.ot. Please visit...

0lever-utils (>=0.0.2 <=0.0.7), 0x-web3 (=5.0.0a5) +2531 more potentially affected by unknown CVE via cryptography (>=0.8.1 <=41.0.2)

cryptography PYPI version =0.8.1, =0.0.2, =0.1.0, =0.5.0rc5, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.1.1, =1.0.0, =2.6.3, =2.3.36, =1.0.4, =2.0.0rc0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-JM77-QPHF-C4W8...