27 matches found
clone-cert
clone-cert.sh これは、TLSでラップされたTCPポートに関連付けられたX.509証明書を取得し、opensslを使用して公開鍵を置き換えて署名を修正することで、類似の証明書を作成するシンプルなシェルスクリプトです。 これは特に、自己署名証明書がなぜセキュリティを提供できないかをデモンストレーションしたい場合に便利です。もちろん、クローンされた証明書のフィンガープリントは異なります...しかし、自己署名証明書のフィンガープリントを手動で確認する人はどれだけいるでしょうか？...
CVE-2026-81702
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, enabling silent key substitution . An attacker can replace legitimate public keys in identity stores with their own while maintaining the claimed fingerprint, so that encryption u...
CVE-2026-81702 openssl_encrypt before 1.4.9 Key Substitution via Identity Load
opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...
EUVD-2026-58723
kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the...
CVE-2026-47192
CVE-2026-47192 affects kas (bitbake project setup tool). From 4.8 up to 5.3, kas may checkout and process repositories for configuration includes before validating signatures, under very specific conditions. If an attacker controls a referenced repository and the victim’s kas config includes a fi...
DEBIAN-CVE-2026-14570
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce a...
EUVD-2026-41713
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce a...
CVE-2026-14570
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce a...
kas's late signature validation may allow unnoticed repository manipulations
Impact So far, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker mus...
[SECURITY] Fedora 44 Update: opkssh-0.13.0-8.fc44
OpenPubkey SSH is a tool which enables ssh to be used with OpenID Connect allowing SSH access to be managed via identities like aliceaexample.com ins tead of long-lived SSH keys...
GHSA-4V42-65R3-3GJX Amazon S3 Encryption Client for .NET has a Key Commitment Issue
Summary S3 Encryption Client for .NET S3EC is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible...
EUVD-2011-2176
Malware in sbrugna...
EUVD-2020-22293
Malware in sbrugna...
EUVD-2024-45562
Malicious code in bioql PyPI...
Security Bulletin: UC Deploy Container images may contain non-unique https certificates and database encryption key. (CVE-2021-39082 )
Summary CVE-2021-39082 The provided UC Deploy Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages. Vulnerability Details...
CVE-2020-2500
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and...
MAL-2022-41 Malicious code in 6jestlr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8502727faa86fcf1f0e21fabb5be58cb389a0bc6f108397bb8942a91584121f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
How to Combat the Biggest Security Risks Posed by Machine Identities
The rise of DevOps culture in enterprises has accelerated product delivery timelines. Automation undoubtedly has its advantages. However, containerization and the rise of cloud software development are exposing organizations to a sprawling new attack surface. Machine identities vastly outnumber...
