CVE-2023-1672 Race condition exists in the key generation and rotation functionality

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host...

CVE-2023-1672

The CVE-2023-1672 entry describes a race condition in Tang server key generation/rotation that could allow Tang private keys to be read by other processes on the same host. Connected advisories/plugins confirm Tang is affected across multiple Linux distributions (e.g., MiracleLinux tang-14-2.el9,...

CVE-2023-1672

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host...

Tang 竞争条件问题漏洞

Tang is an open source server from latchset that binds data to the web. Tang suffers from a security vulnerability that stems from the presence of a competitive condition for key generation and key rotation, which can cause other processes on the same host to read the private key within a short...

OESA-2023-1403 tang security update

This package is a server for binding data to network presence. First, the client gets a list of the Tang server's advertised asymmetric keys. This can happen online by a simple HTTP GET. Alternatively, since the keys are asymmetric, the public key list can be distributed out of band. Second, the...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. Node.js suffers from a security vulnerability that stems from not generating a key after setting a private key, which can easily lead to security issues with using the application...

Internet Bug Bounty: DiffieHellman doesn't generate keys after setting a key

A security vulnerability was discovered in the DiffieHellman module of Node.js. The module did not generate new keys after setting a private key, potentially leading to the reuse of nonces and compromising security measures such as forward secrecy and IND-CPA...

Fedora 38 : tang (2023-3e84bba241)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3e84bba241 advisory. Fixes CVE-2023-1672 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

Fedora 37 : tang (2023-eb9bec6e8c)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-eb9bec6e8c advisory. Fixes CVE-2023-1672 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

CVE-2023-1672

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host...

PT-2023-7323 · Unknown +5 · Tang Server +5

Name of the Vulnerable Software and Affected Versions: Tang server affected versions not specified Description: A race condition exists in the Tang server functionality for key generation and key rotation, resulting in a small time window where Tang private keys become readable by other processes...

CVE-2023-32549

Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator...

CVE-2022-33264

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message...

Stack overflow

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message...

CVE-2022-33264 Stack-based buffer overflow in Modem

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message...

CVE-2022-33264

CVE-2022-33264 is a memory corruption issue in Qualcomm modem components caused by a stack-based buffer overflow during parsing of OTASP Key Generation Request Messages. Affects Qualcomm closed-source/modem firmware; CVSS base score ~7.8–7.9 HIGH with LOCAL exploit. The issue is discussed in Qual...

CVE-2022-33264 Stack-based buffer overflow in Modem

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message...

Qualcomm Chipsets 缓冲区错误漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from a modem memory corruption due to a stack-based buffer overflow when parsing OTASP key generation request messages...

CVE-2022-43485 Insecure random number used for generating keys for signing Jwt tokens

Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1...

IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication

io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time there is an if statement in a loop. One leak is in ecdsa/keygen/round2.go. bnb-chain/tss-lib and...