5638 matches found
Mozilla NSS Denial of Service Vulnerability
NSS is an underlying cryptography library from the Mozilla Foundation. The library supports a variety of cryptographic algorithms and the TLS implementation of the Firefox browser is based on this library. A denial of service vulnerability exists in NSS versions prior to 3.58. The vulnerability...
CVE-2020-25659
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS1 v1.5 ciphertext...
0lever-utils (>=0.0.2 <=0.0.7), 0x-web3 (=5.0.0a5) +1807 more potentially affected by CVE-2020-25659 via cryptography (>=0.6.1 <=3.1.1)
cryptography PYPI version =0.6.1, =0.0.2, =0.1.0, =0.5.0rc5, =1.0.0, =2.6.3, =2.3.36, =1.0.4, =2.8.1, =0.4.0, =2.0.0, =3.3.6 - adversarial-labeller =0.1.8 and more Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...
GHSA-HGGM-JPG3-V476 RSA decryption vulnerable to Bleichenbacher timing vulnerability
RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2...
RSA decryption vulnerable to Bleichenbacher timing vulnerability
RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2...
CVE-2020-25659
A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality...
PT-2020-6703 · Pypi +8 · Python-Cryptography +8
Name of the Vulnerable Software and Affected Versions: python-cryptography versions 3.2 Description: The issue is related to errors in RSA key management in the python-cryptography package for the Python programming language. It may allow a remote attacker to gain unauthorized access to protected...
PYSEC-2020-142
A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting...
CVE-2020-4254
IBM Security Guardium Big Data Intelligence 1.0 SonarG uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 175560...
CVE-2020-4254
IBM Security Guardium Big Data Intelligence (SonarG) 1.0 is affected by CVE-2020-4254 due to weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The IBM Security Guardium Big Data Intelligence product was specifically affected (versi...
CVE-2020-4254
IBM Security Guardium Big Data Intelligence 1.0 SonarG uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 175560...
Zoom Rolls Out End-to-End Encryption After Setbacks
Video-conferencing giant Zoom is rolling out a technical preview of its end-to-end encryption E2EE next week. Zoom has faced various controversies around its encryption policies over the past year, including several lawsuits alleging that the company falsely told users that it offers full...
crate has been renamed to `cipher`
This crate has been renamed from block-cipher to cipher. The new repository location is at:...
aesni (>=0.7.0 <=0.9.0), aries-askar (=0.1.2) +28 more potentially affected by unknown CVE via stream-cipher (>=0.4.1 <=0.7.1)
stream-cipher CARGO version =0.4.1, =0.7.0, =0.1.1, =0.1.1, =0.1.0, =0.4.0, =0.5.0, =0.2.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0-pre.1, =0.1.0, =0.3.1, =0.3.9 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0058...
PHP 7.2 < 7.2.34 / 7.3.x < 7.3.23 / 7.4.x < 7.4.11 Mulitiple Vulnerabilities
According to its self-reported version number, the version of PHP running on the remote web server is 7.2.x prior to 7.2.34, 7.3.x prior to 7.3.23 or 7.4.x prior to 7.4.11. It is, therefore, affected by multiple vulnerabilties: - A weak cryptography vulnerability exists in PHP's opensslencrypt...
Debian: Security Advisory (DLA-2402-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Reconstruct Instead of Validating
Project Zero dropped a great bug in Vault which I think would have been prevented by one of the lessons learned of cryptography engineering: when you can, always prefer reconstructing a value rather than parsing and validating it. You should read the blog post to understand the attack first,...
CVE-2019-4325
"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."...
nss: PKCS#1 v1.5 signatures can be used for TLS 1.3
A vulnerability exists where it possible to force Network Security Services NSS to sign CertificateVerify with PKCS1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerabilit...