RLSA-2021:4424 Moderate: openssl security and bug fix update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: integer overflow in CipherUpdate CVE-2021-23840 openssl: NULL pointer dereference in...

Moderate: libgcrypt security and bug fix update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpipowm CVE-2021-33560 For more details about the security issue...

ALSA-2021:4409 Moderate: libgcrypt security and bug fix update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpipowm CVE-2021-33560 For more details about the security issue...

Predicting the Next OWASP API Security Top 10

As a long-time OWASP member and application security practitioner, I wanted to share my thoughts on how the newly released OWASP Web App Top 10 might impact or influence the updates to the API Security Top 10, last released back in December 2019. These lists cover the most common causes for...

Microsoft Windows CryptoAPI Spoofing Vulnerability

Microsoft Windows CryptoAPI Crypt32.dll contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography ECC certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was fro...

NewStart CGSL MAIN 6.02 : gnutls Vulnerability (NS-SA-2021-0133)

The remote NewStart CGSL host, running version MAIN 6.02, has gnutls packages installed that are affected by a vulnerability: - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve...

F5 Networks BIG-IP : Nettle cryptography library vulnerability (K33101555)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K33101555 advisory. - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA,...

NewStart CGSL MAIN 6.02 : nettle Vulnerability (NS-SA-2021-0132)

The remote NewStart CGSL host, running version MAIN 6.02, has nettle packages installed that are affected by a vulnerability: - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve...

CVE-2020-14264

"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"...

CVE-2020-14264

"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK"...

CVE-2021-38461

The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries...

sodiumoxide is deprecated

Alternatives may be found - not in any specific order: - libsodium-sys-stable - dryoc - RustCrypto/nacl-compat cryptobox, cryptokx, cryptosecretstream - RustCrypto/xsalsa20poly1305 cryptosecretbox - Signatory - ed25519-compact - ed25519-dalek - ring Recommendations can be also found from: - Aweso...

Security Risks of Client-Side Scanning

Even before Apple made its announcement, law enforcement shifted their battle for backdoors to client-side scanning. The idea is that they wouldnt touch the cryptography, but instead eavesdrop on communications and systems before encryption or after decryption. Its not a cryptographic backdoor, b...

Juniper Junos OS Vulnerability (JSA11245)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11245 advisory. - python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS1 v1.5 ciphertext. CVE-2020-25659 Note...

CVE-2021-38862

IBM Data Risk Manager iDNA 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207980...

CVE-2021-38862

IBM Data Risk Manager (iDNA) 2.0.6 is affected by weaker-than-expected cryptographic algorithms that could allow decrypting highly sensitive information. The affected product/version is IBM DRM 2.0.6. Remediation requires upgrading to v2.0.6.8 and then applying FixPack 2.0.6.9 in sequence (not cu...

Moderate: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2021-38862

IBM Data Risk Manager iDNA 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207980...

Keypair 代码问题漏洞

Keypair is an open source package. It is used to generate RSA PEM key pairs in pure JS. Keypair has a code issue vulnerability that stems from. An issue was found when this library was generating the same RSA keys used in SSH. This would mean that the library is generating the same P, Q and...

CVE-2021-38925

IBM Sterling B2B Integrator Standard Edition 5.2.0. 0 through 6.1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 210171...