Low: Red Hat Security Advisory: OpenShift Container Platform 4.4.14 ose-cluster-machine-approver-container security update

An update for ose-cluster-machine-approver-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Low: Red Hat Security Advisory: OpenShift Container Platform 4.4.12 ose-cloud-credential-operator-container security update

An update for ose-cloud-credential-operator-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic

A denial of service vulnerability was found in the SSH package of the golang.org/x/crypto library. An attacker could exploit this flaw by supplying crafted SSH ed25519 keys to cause a crash in applications that use this package as either an SSH client or server...

Low: Red Hat Security Advisory: OpenShift Container Platform 4.4.11 ose-baremetal-operator-container security update

An update for ose-baremetal-operator-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

openssl security and bug fix update

1.1.1c-15 - add selftest of the RANDDRBG implementation 1.1.1c-14 - fix incorrect error return value from FIPSselftestdsa - S390x: properly restore SIGILL signal handler 1.1.1c-12 - additional fix for the edk2 build 1.1.1c-9 - disallow use of SHA-1 signatures in TLS in FIPS mode 1.1.1c-8 - fix...

Signature Verification With Malformed Public Keys

github.com/golang/crypto is vulnerable to signature verification with malformed public keys. The vulnerability exists because it does not handle malformed ed25519 public keys properly, allowing a malicious SSH client to provide malicious a ssh-ed25519 or [email protected] public keys to...

Product update: Virtuozzo Infrastructure Platform 3.0 Update 3 (3.0.3-16)

This update provides fixes and improvements. Vulnerability id: VSTOR-25522 SNMP snmpd.conf should not be replaced after the update. Vulnerability id: VSTOR-25600 S3 Uploading a binary file could fail in some cases. Vulnerability id: VSTOR-26405 WebCP Added support for ED25519 SSH keys...

CVE-2019-15545

An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures...

CVE-2019-15545

An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures...

Design/Logic Flaw

An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures...

CVE-2019-15545

An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures...

CVE-2019-15545

An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures...

CVE-2019-15545

CVE-2019-15545 affects the libp2p-core crate before 0.8.1 for Rust. The root cause is improper verification of ed25519 signatures, where any signature with a correct length could be treated as valid, allowing an attacker to impersonate any node identity. The vulnerability has multiple publicly li...

CVE-2019-15545: Improper Verification of Cryptographic Signature

An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures...

Using Ed25519 signing keys for encryption

@Benjojo12 and I are building an encryption tool that will also support SSH keys as recipients, because everyone effectively already publishes their SSH public keys on GitHub. For RSA keys, this is dangerous but straightforward: a PKCS1 v1.5 signing key is the same as an OAEP encryption key...

RUSTSEC-2019-0004 Failure to properly verify ed25519 signatures makes any signature valid

Affected versions of this crate did not properly verify ed25519 signatures. Any signature with a correct length was considered valid. This allows an attacker to impersonate any node identity...

Failure to properly verify ed25519 signatures makes any signature valid

Affected versions of this crate did not properly verify ed25519 signatures. Any signature with a correct length was considered valid. This allows an attacker to impersonate any node identity...

PT-2019-14261

Name of the Vulnerable Software and Affected Versions libp2p-core crate versions prior to 0.8.1 Description An issue in the libp2p-core crate allows attackers to spoof ed25519 signatures. The affected versions did not properly verify ed25519 signatures, considering any signature with a correct...

Fedora 28 : python-paramiko (2018-8f9d81a3fb)

A flaw was found in the implementation of transport.py in Paramiko, which did not properly check whether authentication was completed before processing other requests. A customized SSH client could simply skip the authentication step. This flaw is a user authentication bypass in the SSH Server...

Docker Notary Forged Signature Vulnerability

Docker Notary is a set of tools for publishing and managing trusted content collections from Docker Inc. in the United States. A security vulnerability exists in the gotuf/signed/verify.go file in Docker Notary versions prior to 0.1. An attacker can exploit this vulnerability to forge signatures ...