Signature Malleability in case of using EVM built-in ecrecover()

Lines of code Vulnerability details Impact The ecrecover function which is used verify a signature. The built-in EVM precompile ecrecover is susceptible to signature malleability because of non-unique s and v values which could lead to replay attacks. Proof of Concept Tools Used Manual Analysis...

Mssing Crucial Checks When Unlocking funds for Withdraw Requests from L2

Lines of code Vulnerability details Impact Atomicity literally does not exist when users from L2 initiate a withdrawal by burning funds on the contract and sending the message to L1. This is giving malicious attackers plenty of time to stealthily launch a series of small and yet sizable forgery o...

bind security update

CentOS Errata and Security Advisory CESA-2022:6765 An update for bind is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Signature replay attacks

Lines of code Vulnerability details Description There is a function deployHolographableContract from the HolographFactory smart contract. Among other things, the function verifies the ECDSA signature. The signed data for verification is constructed as a concatenation of different user-provided...

MGASA-2022-0388 Updated bind packages fix security vulnerability

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. CVE-2022-2795 By spoofing the target resolver with responses that have a malformed ECDSA...

Updated bind packages fix security vulnerability

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. CVE-2022-2795 By spoofing the target resolver with responses that have a malformed ECDSA...

F5 Networks BIG-IP : BIND vulnerability (K27155546)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K27155546 advisory. - By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via fault injection achieved with a rowhammer attack, which exposes ECDSA keys. Remediation Upgrade wolfssl to version 5.5.1 or higher. References - GitHub Commit - GitHub PR - GitHub Release Credit: Yarkin Doroz,...

CVE-2022-42961

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

CVE-2022-42961

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

Crlf injection

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

UBUNTU-CVE-2022-42961

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

CVE-2022-42961

CVE-2022-42961 concerns wolfSSL before 5.5.0, where a Rowhammer RAM fault injection can disclose ECDSA private-key material during signing (e.g., TLS handshakes). The issue may allow leakage of faulty ECC signatures, enabling an advanced technique for ECDSA key recovery. Impact is limited to conf...

PT-2022-26682 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: wolfSSL versions prior to 5.5.0 Description: An issue was discovered in wolfSSL that allows a fault injection attack on RAM via Rowhammer, leading to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in...

CVE-2022-42961

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

CVE-2022-42961

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

CVE-2022-42961

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

CVE-2022-42961

An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via ...

Security Bulletin: IBM Sterling File Gateway is vulnerable to multiple issues due to Bouncy Castle

Summary IBM Sterliing File Gateway has addressed multiple security vulnerabilities in Bouncy Castle. Vulnerability Details CVEID:CVE-2016-1000343 DESCRIPTION: Bouncy Castle JCE Provider could provide weaker than expected security, caused by a flaw in the DSA key pair generator. A remote attacker...

OESA-2022-1983 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...