openssl security update

CentOS Errata and Security Advisory CESA-2016:0008 Updated openssl packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score,...

What the heck is RFC 5114?

Mandatory Disclaimer: IANAC I am not a cryptographer so I might likely end up writing a bunch of mistakes in this blog post... I already talked about Diffie–Hellman DH from now on in TLS in my previous post: Small subgroup attack in Mozilla NSS. As mentioned FWIW I strongly agree with Google Chro...

Vuvuzela - Private Messaging System That Hides Metadata

Vuvuzela is a messaging system that protects the privacy of message contents and message metadata. Users communicating through Vuvuzela do not reveal who they are talking to, even in the presence of powerful nation-state adversaries. Our SOSP 2015 paper explains the system, its threat model,...

GLSA-201512-09 : encfs: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201512-09 encfs: Multiple vulnerabilities Multiple vulnerabilities have been discovered in encfs. Please review the CVE identifiers referenced below for details. Impact : A local attacker can utilize a possible buffer overflow in...

Design/Logic Flaw

Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptography...

CVE-2014-3260

Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptography...

CVE-2014-3260

Affected product: Pacom 1000 CCU and RTU GMS systems. Vulnerability: CVE-2014-3260 arises from cryptographic implementation weaknesses in Pacom GMS, enabling remote attackers to spoof the controller–base data stream. Root cause: improper use of cryptography in the crypto implementation (CWE-310)....

PT-2015-3720

Name of the Vulnerable Software and Affected Versions Pacom 1000 CCU and RTU GMS devices affected versions not specified Description The issue allows remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptography. Recommendations At the moment, there is no...

CVE-2014-3260: Undefined Security Weakness

Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptography...

CenoCipher - Easy-To-Use, End-To-End Encrypted Communications Tool

CenoCipher is a free, open-source, easy-to-use tool for exchanging secure encrypted communications over the internet. It uses strong cryptography to convert messages and files into encrypted cipher-data, which can then be sent to the recipient via regular email or any other channel available, suc...

Debian DSA-3417-1 : bouncycastle - security update

Tibor Jager, Jorg Schwenk, and Juraj Somorovsky, from Horst Gortz Institute for IT Security, published a paper in ESORICS 2015 where they describe an invalid curve attack in Bouncy Castle Crypto, a Java library for cryptography. An attacker is able to recover private Elliptic Curve keys from...

[SECURITY] [DSA 3417-1] bouncycastle security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3417-1 [email protected] https://www.debian.org/security/ Luciano Bello December 14, 2015 https://www.debian.org/security/faq -...

Moderate: Red Hat Security Advisory: openssl security update

Updated openssl packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fro...

Debian Security Advisory DSA 3417-1 (bouncycastle - security update)

Tibor Jager, Jorg Schwenk, and Juraj Somorovsky, from Horst Gortz Institute for IT Security, published a paper in ESORICS 2015 where they describe an invalid curve attack in Bouncy Castle Crypto, a Java library for cryptography. An attacker is able to recover private Elliptic Curve keys from...

DSA-3417-1 bouncycastle - security update

Bulletin has no description...

Code injection

Cisco TelePresence Video Communication Server VCS X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat cryptographic protection mechanisms by leveraging knowledge of a key from another installation, aka Bug ID CSCuw64516...

Private Messaging System: Vuvuzela

Vuvuzela is a messaging system that protects the privacy of message contents and message metadata. Users communicating through Vuvuzela do not reveal who they are talking to, even in the presence of powerful nation-state adversaries. Vuvuzela is the first system that provides strong metadata...

Updated python-cryptography packages fix security vulnerability

The OpenSSL backend prior to 1.0.2 made extensive use of assertions to check response codes where our tests could not trigger a failure. However, when Python is run with -O these asserts are optimized away. If a user ran Python with this flag and got an invalid response code this could result in...

PT-2015-7943

Name of the Vulnerable Software and Affected Versions OpenSSL backend versions prior to 1.0.2 python-cryptography versions prior to 1.0.2 python-cryptography-vectors versions prior to 1.0.2 python-pyasn1 versions prior to 0.1.8 Description The issue arises from the use of assertions in the OpenSS...

CVE-2015-7286: Undefined Security Weakness

CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which makes it easier for remote attackers to defeat a cryptographic protection mechanism by capturing IP or V.22bis PSTN protocol traffic...