CVE-2023-38325

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options...

Weak Cryptography

github.com/supranational/blst is vulnerable to Weak Cryptography. The vulnerability exists due to logic errors in SigValidate function which results in group-check omission...

CLSA-2023-1691576279 Fix CVE(s): CVE-2023-38408

SECURITY UPDATE: helper programs can dlopen/dlclose any libraries from /usr/lib - debian/patches/CVE-2023-38408-Ensure-FIDO-PKCS11-libraries-contain-expect.patch: checks libraries before dlopen - debian/patches/CVE-2023-38408-Separate-ssh-pkcs11-helpers-for-each-p11-mo.patch: separate...

PT-2023-18919 · Hcl · Hcl Dryice Iautomate

Name of the Vulnerable Software and Affected Versions: HCL DRYiCE iAutomate affected versions not specified Description: The issue is related to the use of a broken cryptographic algorithm, which can potentially allow an attacker to compromise the confidentiality and integrity of sensitive...

Lindell17 TSS Injection Vulnerability

tss-lib is an open source IO FinNet implementation of the multi-party t,n- threshold ECDSA Elliptic Curve Digital Signature Algorithm based on Gennaro and Goldfeder 20201 and EdDSA Edwards Curve Digital Signature Algorithm. A security vulnerability exists in Lindell17 TSS that stems from allowing...

CVE-2023-39533

CVE-2023-39533 affects the Go libp2p core/crypto implementation (Noise handshake and x509 verification) where malicious peers can force a resource exhaustion by using large RSA keys. The issue is mitigated by restricting RSA keys to

You Can’t Rush Post-Quantum-Computing Cryptography Standards

I just read an article complaining that NIST is taking too long in finalizing its post-quantum-computing cryptography standards. This process has been going on since 2016, and since that time there has been a huge increase in quantum technology and an equally large increase in quantum understandi...

nodejs: DiffieHellman do not generate keys after setting a private key

A vulnerability has been identified in the Node.js, where a generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet...

The vulnerability of the Data Transfer Security function in software for creating and managing graphical interfaces for control panels in GT Designer3, GOT2000 Series, GOT SIMPLE Series, GT SoftGOT2000, allows a perpetrator to gain unauthorized access to protected information and enhance their privileges.

The vulnerability of the Data Transfer Security function in software for creating and managing graphical interfaces for control panels in GT Designer3, GOT2000 Series, GOT SIMPLE Series, and GT SoftGOT2000 is related to weak cryptography for passwords. Exploiting this vulnerability can allow...

CVE-2023-3180

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtiocryptohandlesymreq. There is no check for the value of srclen and dstlen in virtiocryptosymophelper, potentially leading to a heap buffer overflow when the two values differ...

Dependency On Vulnerable Third-Party Component

cryptography contains a Dependency On a Vulnerable Third-Party Component. The use of the bundled OpenSSL component which contains several security issues which allows an attacker to disrupt secure operations in the library. Only users installing from wheels built by the cryptography pip library a...

PT-2023-4152 · Mitsubishi · Gt Softgot2000 +3

Name of the Vulnerable Software and Affected Versions: GT Designer3 versions affected versions not specified GOT2000 Series versions affected versions not specified GOT SIMPLE Series versions affected versions not specified GT SoftGOT2000 versions affected versions not specified Description: The...

AZL-37344 CVE-2023-29409 affecting package golang for versions less than 1.21.6-1

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three...

Moxa EDR-810 Web Server Weak Cryptography for Passwords (CVE-2017-12129)

An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could intercept weakly encrypted passwords and could brute force them. This plugin only works with Tenable.ot. Please visit...

pyca/cryptography's wheels include vulnerable OpenSSL

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt,...

GHSA-JM77-QPHF-C4W8 pyca/cryptography's wheels include vulnerable OpenSSL

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt,...

openssh: Remote code execution in ssh-agent PKCS#11 support

A vulnerability was found in OpenSSH. The PKCS11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system the code in /usr/lib is not necessarily safe for loading into ssh-agent...

openssh: Remote code execution in ssh-agent PKCS#11 support

A vulnerability was found in OpenSSH. The PKCS11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system the code in /usr/lib is not necessarily safe for loading into ssh-agent...

Huawei EulerOS: Security Advisory for python-cryptography (EulerOS-SA-2023-2518)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for python-cryptography (EulerOS-SA-2023-2531)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...