MAL-2022-3850 Malicious code in insomnia-plugin-simple-hmac-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82257b4c71933f16336920865f08941bf1fd250ffd06dd3e34a99e3319b78012 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-32226

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.283 Description The issue concerns the seg6 hmac init function. It was introduced in version v4.10 and fixed in Linux Kernel version v4.14.283. The actual impact and attack plausibility have not yet been...

PT-2022-31776

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.122 Description The issue concerns the seg6 hmac init function. It was introduced in version v4.10 and fixed in Linux Kernel version v5.10.122. The actual impact and attack plausibility have not yet been...

PT-2022-31220

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.15 Description The issue concerns the seg6 hmac init function. It was introduced in version v4.10 and fixed in Linux Kernel version v5.17.15. The actual impact and attack plausibility have not yet been...

PT-2022-32111

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.247 Description The issue is related to the seg6 hmac init function in the Linux Kernel's IPv6 implementation. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-31966

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.198 Description The issue concerns the seg6 hmac init function. It was introduced in version v4.10 and fixed in Linux Kernel version v5.4.198. The actual impact and attack plausibility have not yet been...

PT-2022-31518

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.47 Description The issue concerns the seg6 hmac init function. It was introduced in version v4.10 and is fixed in Linux Kernel version v5.15.47. The actual impact and attack plausibility have not yet been...

PT-2022-30851

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.4 Description The issue concerns a potential security vulnerability in the Linux Kernel. It is related to the seg6 hmac init function. The actual impact and attack plausibility have not yet been proven...

OPENSUSE-SU-2022:10018-1 Security update for atheme

This update for atheme fixes the following issues: atheme was updated to release 7.2.12: CVE-2022-24976: Fixed General authentication bypass in Atheme IRC services with InspIRCd 3 boo1195989 Track SASL login EID Update to release 7.2.11 Add a preliminary Turkish translation Add HMAC-MD5 verify-on...

Security update for atheme (important)

openSUSE Security Update: Security update for atheme Announcement ID: openSUSE-SU-2022:10018-1 Rating: important References: 1174075 1195989 Cross-References: CVE-2022-24976 CVSS scores: CVE-2022-24976 NVD : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Backports...

CVE-2022-29226 Trivial authentication bypass in Envoy

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current...

PT-2025-8273

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been identified, related to the seg6 hmac init function, which is annotated with init and exported using EXPORT SYMBOL. This combination is...

PT-2022-37905

Уязвимость функции seg6 hmac init модуля net/ipv6/seg6 hmac.c ядра операционной системы Linux связана с некорректной инициализацией. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Key confusion through non-blocklisted public key formats

Impact What kind of vulnerability is it? Who is impacted? Disclosed by Aapo Oksman Senior Security Specialist, Nixu Corporation. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requir...

GHSA-6MWH-FW4P-75FJ Deserialization of Untrusted Data in Apache Tapestry

By manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this...

Non-constant time HMAC comparison

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value. Jenkins 2.219, LTS 2.204.2 now use...

new packages: perl-Digest-HMAC

An update is available for perl-Digest-HMAC. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

GHSA-7JFM-PX59-99W8 Typo3 Extbase Framework Unsafe Deserialization

The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature HMAC for a request argument."...

TYPO3 Improper Access Control vulnerability

The old Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors...

GHSA-W799-PRG3-CX77 python-jose failure to use a constant time comparison for HMAC keys

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys...