Rockwell Automation Stratix Anonymous ECDH Denial of Service (CVE-2014-3470)

Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to execute arbitrary code, create a denial of service DoS condition, or perform a man-in-the-middle attack. This plugin only works with...

WS-2023-0322

The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is "secp384r1". Using any other curve fo...

GHSA-79RC-JJH6-RC89 PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

Impact The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is secp384r1. Using any other cur...

PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

Impact The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is secp384r1. Using any other cur...

PT-2023-32987

Name of the Vulnerable Software and Affected Versions Minecraft: Bedrock Edition versions prior to 4.23.1 Minecraft: Bedrock Edition versions prior to 5.3.1 Description The issue arises from the server's use of ECDH to calculate a shared secret for symmetric encryption key used to encrypt network...

Oracle Linux 7 : docker-engine (ELSA-2019-4550)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-4550 advisory. - apply fix for runc CVE-2019-5736 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Oracle Linux 7 : kubernetes (ELSA-2019-4546)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4546 advisory. - CVE-2019-6486 - CVE-2018-1002105 Handle error responses from backends - Ensure that the runtime mounts RO volumes read-only CVE-2017-1002102 - Update Dashboar...

golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results

A flaw was found in the crypto/internal/nistec golang library. The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars, such as a scalar larger than the order of the curve. This does not impact usages of crypto/ecds...

RTM Locker's First Linux Ransomware Strain Targeting NAS and ESXi Hosts

The threat actors behind RTM Locker have developed a ransomware strain that's capable of targeting Linux machines, marking the group's first foray into the open source operating system. "Its locker ransomware infects Linux, NAS, and ESXi hosts and appears to be inspired by Babuk ransomware's leak...

Security Bulletin: IBM BladeCenter Advanced Management Module is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, and CVE-2014-3470.

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Content Vulnerability...

Fedora 38 : golang (2023-8ee7d4a8e3)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-8ee7d4a8e3 advisory. go1.20.2 released 2023-03-07 includes a security fix to the crypto/elliptic package, as well as bug fixes to the compiler, the covdata command, the linker, t...

Linux: BSI TR-02102-4 3.3 Key Exchange Methods

When establishing the SSH connection, keys are exchanged in order to create and exchange shared session keys for authentication and encryption. The following key exchange methods are recommended: diffie-hellman-group-exchange-sha256, diffie-hellman-group15-sha512, diffie-hellman-group16-sha512,...

AZL-37373 CVE-2023-24532 affecting package golang for versions less than 1.21.6-1

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh...

CVE-2023-24532

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh...

Code injection

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh...

CVE-2023-24532

CVE-2023-24532 involves the ScalarMult and ScalarBaseMult methods on the Go golang P256 curve. The vulnerability can yield an incorrect result when invoked with certain unreduced scalars larger than the curve order. The issue does not affect usages of crypto/ecdsa or crypto/ecdh. Public advisorie...

Debian: Security Advisory (DLA-132-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-24532

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh...

ECDH Private Key Disclosure

ecdh is vulnerable to ECDH Private Key Disclosure. The vulnerability exists because the deriveSharedSecret function in index.js does not properly check if a point is on the curve, allowing an attacker to retrieve the derived shared secret...

simple-ec (>=1.0.0, <=2.1.0), sudp (>=0.0.0, <=0.1.0) potentially affected by CVE-2022-44310 via ecdh (>=0.0.0, <=0.1.1)

ecdh NPM version =0.0.0, =1.0.0, =0.0.0, =0.1.0 Source cves: CVE-2022-44310 Source advisory: OSV:GHSA-P2HP-3WV3-4W74...