Avoid The Randomness From The Sky

This is a plea for cryptography specification authors. If your protocol uses randomness, please make it a deterministic function that takes a fixed-size string of random bytes , and publish known-answer tests for it. This whole issue could really be just the paragraph above, but I feel like I nee...

SUSE SLES15 Security Update : python-cryptography, python-cryptography-vectors (SUSE-SU-2023:0604-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0604-1 advisory. - Update in SLE-15 bsc1199282, jscPM-3243, jscSLE-24629 - CVE-2020-36242: Fixed a bug where certain sequences of update calls could...

SUSE-SU-2023:0604-1 Security update for python-cryptography, python-cryptography-vectors

This update for python-cryptography, python-cryptography-vectors fixes the following issues: - Update in SLE-15 bsc1199282, jscPM-3243, jscSLE-24629 - CVE-2020-36242: Fixed a bug where certain sequences of update calls could result in integer overflow bsc1182066. - CVE-2020-25659: Fixed...

CVE-2023-23931 affecting package python-cryptography 3.3.2-1

CVE-2023-23931 affecting package python-cryptography 3.3.2-1. A patched version of the package is available...

The vulnerability of the PowerScale OneFS operating systems is related to weak password cryptography for NDMP. This allows attackers to gain full control over the system.

The vulnerability of the PowerScale OneFS operating system is related to the weak cryptography used for NDMP password protection. Exploiting this vulnerability could allow an attacker to gain full control over the system...

CVE-2023-20940

In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

USN-5901-1 gnutls28 vulnerability

Hubert Kario discovered that GnuTLS had a timing side-channel when handling certain RSA messages. A remote attacker could possibly use this issue to recover sensitive information...

Side-Channel Attack against CRYSTALS-Kyber

CRYSTALS-Kyber is one of the public-key algorithms currently recommended by NIST as part of its post-quantum cryptography standardization process. Researchers have just published a side-channel attack--using power consumption--against an implementation of the algorithm that was supposed to be...

openssl: timing attack in RSA Decryption implementation

A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover a ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, an attacker would have to be able to send a very large number of trial messages...

Moderate: openssl security and bug fix update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: read buffer overflow in X.509 certificate verification CVE-2022-4203 openssl: timing attack in RS...

ALSA-2023:0946 Moderate: openssl security and bug fix update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: read buffer overflow in X.509 certificate verification CVE-2022-4203 openssl: timing attack in RS...

Updated python-cryptography packages fix security vulnerability

Cipher.updateinto would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects such as 'bytes' to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an...

USN-5892-1 nss vulnerabilities

It was discovered that NSS incorrectly handled client authentication without a user certificate in the database. A remote attacker could possibly use this issue to cause a NSS client to crash, resulting in a denial of service. This issue only affected Ubuntu 22.10. CVE-2022-3479 Christian Holler...

[SECURITY] Fedora 37 Update: python-cryptography-37.0.2-5.fc37

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

Fedora: Security Advisory for python-cryptography (FEDORA-2023-fa5d0b461d)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

DLA-3331-2 python-cryptography - regression update

Bulletin has no description...

Fedora 37 : python-cryptography (2023-fa5d0b461d)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-fa5d0b461d advisory. Security fix for CVE-2023-23931 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected...

Debian: Security Advisory (DLA-3331-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3331-1] python-cryptography security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3331-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb February 21, 2023 https://wiki.debian.org/LTS -...

K33101555: Nettle cryptography library vulnerability CVE-2021-20305

Security Advisory Description A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in...