CVE-2022-21449-vuln-test

CVE-2022-21449 脆弱性テスター はじめに 新しい CVE-2022-21449 は、ECDSA署名検証にバグがあるものです。これは例えばJWTで使用されるアルゴリズムの一つです。ブログ記事を引用すると： もし Java 15、Java 16、Java 17、Java 18 を本番環境にデプロイしているなら、今すぐ作業を止めて、2022年4月のCritical Patch Updateの修正を適用するために直ちにアップデートすべきです。 実行方法 root@kitploit: ./gradlew package && java -jar target/vulntest.jar...

CurveBall

CurveBall CVE-2020-0601 - PoC CVE-2020-0601: 別名CurveBallまたはChainOffFoolsとしても知られ、Microsoft CryptoApi（具体的にはCrypt32.dll）における脆弱性であり、証明書の楕円曲線署名（ECDSA）が正しく検証されないものです。 この問題を非常に明確に説明している素晴らしいブログ記事がこちらにあります。 これは教育および研究目的でのみ使用してください！ 使い方 コンソールアプリケーションに楕円曲線証明書のパスを指定します。 root@kitploit: CurveBall.exe...

K000163154: wolfSSL vulnerability CVE-2026-5194

Security Advisory Description Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA...

Updated putty packages fix security vulnerabilities

ECDSA signature verification can be made to fail an assertion. Server can provoke a double free in RSA KEX code. Telnet session data is marked with trust sigils after authenticating to a proxy. PuTTY Ed25519 Signature ecc-ssh.c eddsaverify signature verification. CVE-2026-4115...

SUSE CVE-2026-48852

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification...

CVE-2026-44900

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in SignedPublicKeysTrustValidatorImpl.isTrusted, the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify. The method performs certificate chain...

Linux Distros Unpatched Vulnerability : CVE-2026-48852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification. CVE-2026-48852 Note that Nessus relies on the presence of the package as report...

DEBIAN-CVE-2026-48852

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification...

CVE-2026-48852

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification...

CVE-2026-48852

PuTTY 0.71 before 0.84 is affected by an assertion failure in ECDSA signature verification (CVE-2026-48852). The public data specifies affected version range and impact but provides no remediation details in the documents. The CVSS v3.1 vector yields a LOW overall impact (availability loss) with ...

putty -- multiple security vulnerabilities

Simon Tatham reports: These features are new in PuTTY 0.84: Security issue: fixed a remotely triggerable double-free in RSA key exchange. We don't know of any way it is exploitable to execute code. Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. An...

Linux Distros Unpatched Vulnerability : CVE-2026-5194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant ke...

UBUNTU-CVE-2026-5194

Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication...

CVE-2026-5194

The CVE-2026-5194 issue concerns wolfSSL’s ECDSA certificate verification: missing hash/digest size and OID checks may allow digests smaller than allowed for the given key type to pass verification when EdDSA or ML-DSA is enabled. This could reduce security of ECDSA certificate-based authenticati...

MiracleLinux 8 : bind-9.11.36-3.el8.1 (AXSA:2022-3874:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3874:03 advisory. bind: memory leak in ECDSA DNSSEC verification code CVE-2022-38177 bind: memory leaks in EdDSA DNSSEC verification code CVE-2022-38178 Tenable has...

EUVD-2017-9281

Malware in sbrugna...

SUSE CVE-2024-48948

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an truncateToN anomaly. This leads to...

UBUNTU-CVE-2024-48948

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an truncateToN anomaly. This leads to...

The vulnerability of the wc_ecc_sign_hash() function in the SSL/TLS library WolfSSL, which allows a hacker to gain unauthorized access to protected information

The vulnerability of the wceccsignhash function in the SSL/TLS library WolfSSL is related to improper verification of the ECDSA cryptographic signature during the processing of elliptical curve values. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...

The vulnerability of the WOLFSSL_CHECKSIG_FAULTS configuration in the SSL/TLS WolfSSL library allows a perpetrator to gain unauthorized access to protected information. [source-iocs-preserved const=WOLFSSL_CHECK_SIG_FAULTS]

The vulnerability of the WOLFSSLCHECKSIGFAULTS configuration in the SSL/TLS library WolfSSL is related to improper verification of the ECDSA cryptographic signature. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by performing a Rowhammer...