5655 matches found
The Legal Risks of Security Research
Sunoo Park and Kendra Albert have published "A Researcher’s Guide to Some Legal Risks of Security Research." From a summary: Such risk extends beyond anti-hacking laws, implicating copyright law and anti-circumvention provisions DMCA §1201, electronic privacy law ECPA, and cryptography export...
Widevine-L3-Decryptor - A Chrome Extension That Demonstrates Bypassing Widevine L3 DRM
Widevine is a Google-owned DRM system that's in use by many popular streaming services Netflix, Spotify, etc. to prevent media content from being downloaded. But Widevine's least secure security level, L3, as used in most browsers and PCs, is implemented 100% in software i.e no hardware TEEs,...
PT-2020-4927 · Synology · Synology Router Manager
Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.4-8081 Description: The issue concerns a problem with the QuickConnect feature in Synology Router Manager, which allows for a man-in-the-middle attack. This could enable an attacker to spoof...
Insecure RSA Decryption (Bleichenbacher Timing Vulnerability)
cryptography is using insecure RSA Decryption and is vulnerable to Bleichenbacher Timing Vulnerability. When RSA decryption is used in online scenarios, it does not use RSA PKCS1v1.5 decryption with constant time, allowing an attacker to passively record traffic and later decrypt it...
CVE-2020-25659
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS1 v1.5 ciphertext...
Mozilla NSS Denial of Service Vulnerability
NSS is an underlying cryptography library from the Mozilla Foundation. The library supports a variety of cryptographic algorithms and the TLS implementation of the Firefox browser is based on this library. A denial of service vulnerability exists in NSS versions prior to 3.58. The vulnerability...
GHSA-HGGM-JPG3-V476 RSA decryption vulnerable to Bleichenbacher timing vulnerability
RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2...
RSA decryption vulnerable to Bleichenbacher timing vulnerability
RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2...
CVE-2020-25659
A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality...
PT-2020-6703 · Pypi +8 · Python-Cryptography +8
Name of the Vulnerable Software and Affected Versions: python-cryptography versions 3.2 Description: The issue is related to errors in RSA key management in the python-cryptography package for the Python programming language. It may allow a remote attacker to gain unauthorized access to protected...
PYSEC-2020-142
A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting...
CVE-2020-4254
IBM Security Guardium Big Data Intelligence 1.0 SonarG uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 175560...
CVE-2020-4254
IBM Security Guardium Big Data Intelligence (SonarG) 1.0 is affected by CVE-2020-4254 due to weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The IBM Security Guardium Big Data Intelligence product was specifically affected (versi...
CVE-2020-4254
IBM Security Guardium Big Data Intelligence 1.0 SonarG uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 175560...
Zoom Rolls Out End-to-End Encryption After Setbacks
Video-conferencing giant Zoom is rolling out a technical preview of its end-to-end encryption E2EE next week. Zoom has faced various controversies around its encryption policies over the past year, including several lawsuits alleging that the company falsely told users that it offers full...
crate has been renamed to `cipher`
This crate has been renamed from block-cipher to cipher. The new repository location is at:...
PHP 7.2 < 7.2.34 / 7.3.x < 7.3.23 / 7.4.x < 7.4.11 Mulitiple Vulnerabilities
According to its self-reported version number, the version of PHP running on the remote web server is 7.2.x prior to 7.2.34, 7.3.x prior to 7.3.23 or 7.4.x prior to 7.4.11. It is, therefore, affected by multiple vulnerabilties: - A weak cryptography vulnerability exists in PHP's opensslencrypt...
Debian: Security Advisory (DLA-2402-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Reconstruct Instead of Validating
Project Zero dropped a great bug in Vault which I think would have been prevented by one of the lessons learned of cryptography engineering: when you can, always prefer reconstructing a value rather than parsing and validating it. You should read the blog post to understand the attack first,...