PT-2022-22145 · Ibm · Ibm Sterling Secure Proxy

Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy version 6.0.3 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations: For IBM Sterling...

Upgraded Q -> M from #373 [1670018401792]

Judge has assessed an item in Issue 373 as M risk. The relevant finding follows: N2. ETH not accumulated in previewAccumulatedETH supposed to have accumulated += ... Although it is an external view function, depending on its usages, it may present more issues to the callers. --- The text was...

3 New Vulnerabilities Affect OT Products from German Companies Festo and CODESYS

Researchers have disclosed details of three new security vulnerabilities affecting operational technology OT products from CODESYS and Festo that could lead to source code tampering and denial-of-service DoS. The vulnerabilities, reported by Forescout Vedere Labs, are the latest in a long list of...

SUSE SLED15: python2-cryptography / python2-cryptography-vectors / etc (SUSE-SU-2022:4044-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4044-1 advisory. - Update in SLE-15 bsc1177083, jscPM-2730, jscSLE-18312 - Refresh patches for new version - Update in...

SUSE-SU-2022:4044-1 Security update for python-cryptography, python-cryptography-vectors

This update for python-cryptography, python-cryptography-vectors fixes the following issues: - Update in SLE-15 bsc1177083, jscPM-2730, jscSLE-18312 - Refresh patches for new version - Update in SLE-15 bsc1176785, jscECO-3105, jscPM-2352 - update to 2.9.2 2.9.2 - 2020-04-22 - Updated the macOS...

SUSE: Security Advisory (SUSE-SU-2022:4044-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...

python-cryptography bug fix and enhancement update

An update is available for python-cryptography. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rock...

CVE-2022-34320

IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229464...

GSD-2022-1007396 crypto: akcipher - default implementation for setting a private key

crypto: akcipher - default implementation for setting a private key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.220 by commit...

CVE-2022-34320 IBM CICS TX information disclosure

IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229464...

CVE-2022-34319 IBM CICS TX information disclosure

IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229463...

PT-2022-35508 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.17 through v5.10.149 Description: The issue concerns a fix for DMA transfer direction in the crypto: qat module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

CVE-2022-41125

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability...

PT-2022-6324 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.x through 9.4.x Description: The issue is related to a weak encoding for a NDMP password in Dell PowerScale OneFS. A malicious and privileged local attacker could potentially exploit this, leading to a full...

Upgraded Q -> H from 149 [1667660267515]

Judge has assessed an item in Issue 149 as High risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Improve Post-Quantum Cryptography Security with CSPM

Gain valuable insight into the emerging world of post-quantum computing. Understand the threats attackers with access to quantum computers pose. Learn how harnessing the power of cloud security posture management CSPM can mitigate these looming dangers...

Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-38.0.3 are vulnerable to a number of security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221101.txt...

GHSA-39HC-V87J-747X Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-38.0.3 are vulnerable to a number of security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221101.txt...

PT-2022-28180 · Pyca · Cryptography

Name of the Vulnerable Software and Affected Versions: cryptography versions 37.0.0 through 38.0.3 Description: The issue concerns the statically linked copy of OpenSSL in pyca/cryptography's wheels. The included versions of OpenSSL are affected by several security issues, details of which can be...