AIS3-2024-Project-D5Team

AIS3-2024-Project-TeamD5 Reappear-CVE-2022-21449-TLS-PoC 首先開始之前 我想感謝與致敬一些人 1 Neil Madden ; 發現並揭露 CVE-2022-21449, 這是他出色的 WriteUp 2 Khaled Nassar ; 完成 PoC 方便 Demo 3 育正葛葛的資安遊樂場 ; 使用淺顯易懂的方式利用YT影片描述此 CVE 4 AIS3的D組助教們 ; 感謝專題中各種 想法/資源/技術 支援 感謝上述的大神資源與支援 很強大的學習榜樣 AIS3 Team D5 表示感謝 ! HackMDTeamD5 共筆按我即可飛...

CVE-2022-21449-vuln-test

CVE-2022-21449 漏洞测试工具 简介 Java 中新增了一个 CVE-2022-21449，该漏洞存在于 ECDSA 签名验证中。它是 JWT 等场景使用的算法之一。引用博客内容： 如果你在生产环境中部署了 Java 15、Java 16、Java 17 或 Java 18，应立即停止当前操作， 并立即更新以安装 2022 年 4 月关键补丁更新中的修复程序。 运行方式 ./gradlew package && java -jar target/vulntest.jar 如果用于运行该工具的 JVM 存在签名验证漏洞，则会显示 VULNERABLE，否则显示 not...

jfrog-CVE-2022-21449

CVE-2022-21449 概述 该工具允许对编译后的代码归档文件（.jar、.war 等）进行快速扫描，通过查找指示使用 ECDSA 算法的字符串，以检查是否存在 CVE-2022-21449 漏洞。该工具使用 Python3，无需额外依赖。 用法 python cve202221449.py root-folder -quiet -exclude folder1 folder2 .. 或 python cve202221449.py root-archive -quiet -exclude folder1 folder2 .. 该工具将递归扫描 rootfolder 中的 .jar...

SignChecker

SignChecker 用于演示 CVE-2022-21449 漏洞的测试工具。...

CVE-2022-21449-TLS-PoC

CVE-2022-21449-TLS-PoC CVE-2022-21449（在 Neil Madden 的漏洞分析文章中也被称为“Psychic Signatures”）的概念验证，演示了如何将其用于易受攻击的客户端和恶意 TLS 服务器。 恶意服务器展示了一个截至 2022-04-20 对 www.google.com 有效的证书链，该证书链带有 ECDSA 公钥（secp256r1）。但是，crypto/ecdsa 包已被修改为提供 r = s = 0 的无效签名。易受攻击的客户端接受此无效签名，从而使 TLS 握手能够继续进行。 除了在构建和探索过程中移除的 test.go...

CVE-2022-21449-showcase

演示程序，展示CVE-2022-21449 请在JDK 17.0.0下运行 哦对了，这是截图...

CVE-2022-21449

此存储库没有 README。...

psychic-signatures

CVE-2022-21449：Java 中的心灵签名...

CVE-2022-21449

CVE-2022-21449 用于检测针对 TLS 客户端的 CVE-2022-21449 利用尝试的 Zeek 脚本。仅适用于 TLS 1.2 及以下版本。 安装 zkg install https://github.com/thack1/CVE-2022-21449 运行 对提供的 pcap 文件运行： $ zeek -Cr pcaps/CVE-2022-21449.pcap CVE-2022-21449 示例通知 separator \x09 setseparator , emptyfield empty unsetfield - path notice open...

CVE-2022-21449

CVE 2022 21449 Python実装 このプロジェクトでは、以下のことが可能です： 有限体上またはそれ以外の、任意のパラメータを持つ楕円曲線の描画 与えられた楕円曲線から鍵ペアの生成 ECIESによるメッセージの暗号化/復号化 ECDSAを使用した署名/検証 CVE 2022 21449の攻撃シミュレーション ファイルの場所 doc/ このフォルダ内の全ファイルは一時的なもので、後日1つのファイルにまとめられます doc/Introduction à la cryptographie asymétrique.pdf...

K32172755: Multiple Java vulnerabilities CVE-2022-21426, CVE-2022-21434, CVE-2022-21443, CVE-2022-21476, and CVE-2022-21496

Security Advisory Description CVE-2022-21426 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5,...

AlmaLinux 9 : java-17-openjdk (ALSA-2022:1729)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1729 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Java is used by IBM Robotic Process Automation for Cloud Pak as part of several container services that run Java applications. Vulnerability Details CVEID:CVE-2022-21496 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated...

RHEL 9 : java-17-openjdk (RHSA-2022:1729)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1729 advisory. The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixe...

SUSE: Security Advisory (SUSE-SU-2022:2650-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for java-1_8_0-ibm (SUSE-SU-2022:2650-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE: Security Advisory (SUSE-SU-2022:2539-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2022:2540-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:2540-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 7 Fix Pack 10 bsc1201643, including fixes for: - CVE-2022-21476 bsc1198671, CVE-2022-21449 bsc1198670, CVE-2022-21496 bsc1198673, CVE-2022-21434 bsc1198674, CVE-2022-21426 bsc1198672, CVE-2022-21443...

OESA-2022-1702 openjdk-latest security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2...