302 matches found
Apache Hive 信息泄露漏洞
Apache Hive is a suite of data warehouse software based on Hadoop Distributed Systems Infrastructure from the Apache Apache Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. An...
jenkins: Non-constant time comparison of inbound TCP agent connection secret
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret...
jenkins: Non-constant time HMAC comparison
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC...
jenkins: Non-constant time HMAC comparison
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC...
Jenkins < 2.219, < 2.204.2 LTS Multiple Vulnerabilities - Linux
Jenkins is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2020-2102
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC...
CVE-2020-2102
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC...
Design/Logic Flaw
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC...
CVE-2020-2102
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC...
RHEL 7 : java-11-openjdk (RHSA-2019:1810)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1810 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...
OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344)
Vulnerability in the Java SE component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...
Timing Attack
SimpleCrypto.Net is vulnerable to timing attack. A non-constant time comparison function used to compare passwords allow remote attackers to determine valid passwords by analyzing the server response time...
Timing Attacks
Stripe.net is vulnerable to timing attacks. The vulnerability exists due to the usage of non-constant time comparison methods, which causes information to be revealed through different time taken when comparing signatures...
Security Bulletin: Vulnerabilities in OpenSSL affect IBM Tealeaf Customer Experience
Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM Tealeaf Customer Experience. IBM Tealeaf Customer Experience has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6304 DESCRIPTION: OpenSSL is vulnerable ...
Intel Integrated Performance Primitives Cryptography Library Information Disclosure Vulnerability
Intel Integrated Performance Primitives Cryptography Library is a multi-threaded library for multimedia and data processing applications from Intel Corporation. A security vulnerability exists in certain implementations of the Intel Integrated Performance Primitives Cryptography Library versions...
Intel Integrated Performance Primitives Cryptography Library Information Disclosure Vulnerability
Intel Integrated Performance Primitives Cryptography Library is a multi-threaded library for multimedia and data processing applications from Intel Corporation. A security vulnerability exists in Intel Integrated Performance Primitives Cryptography Library versions prior to 2018 U2.1, which stems...
CVE-2017-2585
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks...
CVE-2017-2585
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks...
Icinga Password Disclosure Vulnerability
Icinga is an open source computer system and network monitoring application. Icinga suffers from a password disclosure vulnerability. The vulnerability arises due to the lack of a constant time password comparison feature. An attacker can exploit this vulnerability to obtain a password...