python3 security update

3.9.18-3.3 - Security fix for CVE-2024-4032 Resolves: RHEL-44106 3.9.18-3.2 - Enable importing of hash-based .pyc files under FIPS mode Resolves: RHEL-40767...

python3 security update

3.11.7-1.3 - Security fix for CVE-2024-4032 Resolves: RHEL-44097 3.11.7-1.2 - Enable importing of hash-based .pyc files under FIPS mode Resolves: RHEL-40785...

The vulnerability of the gcry_md_get_algo_dlen() function in ClusterLabs Booth’s high-availability cluster management and monitoring software allows a attacker to perform an invalid HMAC.

The vulnerability of the gcrymdgetalgodlen function in ClusterLabs Booth’s high-availability cluster management and monitoring software is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow an attacker operating remotely to generate invalid HMACs...

PT-2024-6943 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the tpm buf check hmac response function in the Linux kernel's Trusted Platform Module TPM driver. It involves a null pointer dereference when TCG TPM2 HMAC is...

booth: specially crafted hash can lead to invalid HMAC being accepted by Booth server

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcrymdgetalgodlen, it may allow an invalid HMAC to be accepted by the Booth server...

Oracle Linux 8 : python3 (ELSA-2024-4243)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4243 advisory. 3.12.3-2 - Enable importing of hash-based .pyc files under FIPS mode Resolves: RHEL-40776 3.12.3-1 - Update to 3.12.3 Related: RHEL-33685 3.12.2-3 - Move all te...

GHSA-5357-C2JX-V7QH Authlib has algorithm confusion with asymmetric public keys

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. This is similar to CVE-2022-29217 and CVE-2024-33663...

DEBIAN-CVE-2024-37568

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. This is similar to CVE-2022-29217 and CVE-2024-33663...

booth: specially crafted hash can lead to invalid HMAC being accepted by Booth server

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcrymdgetalgodlen, it may allow an invalid HMAC to be accepted by the Booth server...

booth Data forgery vulnerability

booth is an open source ticket manager from ClusterLabs. Booth suffers from a Data Forgery Issue vulnerability that stems from the fact that a specially crafted hash, if passed to gcrymdgetalgodlen, could allow the Booth server to accept an invalid HMAC...

PT-2024-40101 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue concerns insecure deserialization in Extbase request handling. It requires a user-submitted payload to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionK...

SUSE CVE-2022-48687

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes:...

PT-2024-3101 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions prior to 1.10.3-lts Description: The issue is related to the password verification in the source code of 1Panel, which uses the != symbol instead of hmac.Equal. This may lead to a timing attack vulnerability, potentially...

PT-2024-2315 · Siemens · Cerberus Pro En Fire Panel Fc72X Ip7 +21

Name of the Vulnerable Software and Affected Versions: Cerberus PRO EN Engineering Tool versions prior to MP4 Cerberus PRO EN Fire Panel FC72x IP6 versions prior to IP8 SR4 Cerberus PRO EN Fire Panel FC72x IP7 versions prior to IP8 SR4 Cerberus PRO EN Fire Panel FC72x IP8 versions prior to IP8 SR...

CodeIgniter Shield Security Vulnerabilities

CodeIgniter Shield is the authentication and authorization module for CodeIgniter 4 from CodeIgniter, Inc. A security vulnerability exists in CodeIgniter Shield versions prior to 1.0.0-beta.8 that stems from the use of plaintext to store sensitive information in HMAC SHA256 authentication...

The vulnerability of the implementation of the HMAC (Hash-based Message Authentication Code) algorithm in Windows operating systems allows attackers to circumvent security restrictions and enhance their privileges.

The vulnerability of the HMAC Hash-based Message Authentication Code algorithm implementation in Windows operating systems is related to deficiencies in access control during key generation. Exploiting this vulnerability can allow attackers to circumvent security restrictions and enhance their...

CVE-2023-36400

Windows HMAC Key Derivation Elevation of Privilege Vulnerability...

The vulnerability of the hmac.compare_digest function in the Lib/hmac.py library of the Python interpreter allows a attacker to enhance their privileges.

The vulnerability of the hmac.comparedigest function in the Lib/hmac.py library of the Python interpreter is related to synchronization errors when using a shared resource “Race Condition”. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

GHSA-H929-FVVP-882C Duplicate Advisory: EVE Seals Vault Key With SHA1 PCRs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wc42-fcjp-v8vq. This link is maintained to preserve external references. Original Description Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism...

VTScanner - A Comprehensive Python-based Security Tool For File Scanning, Malware Detection, And Analysis In An Ever-Evolving Cyber Landscape

VTScanner is a versatile Python tool that empowers users to perform comprehensive file scans within a selected directory for malware detection and analysis. It seamlessly integrates with the VirusTotal API to deliver extensive insights into the safety of your files. VTScanner is compatible with...