Huawei EulerOS: Security Advisory for gnutls (EulerOS-SA-2017-1203)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for gnutls (EulerOS-SA-2017-1204)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2019:1391-2 Security update for evolution

This update for evolution fixes the following issue: Security issue fixed: - CVE-2018-15587: Fixed OpenPGP signatures spoofing via specially crafted email that contains a valid signature bsc1125230...

[ASA-201910-11] go-pie: denial of service

Arch Linux Security Advisory ASA-201910-11 ========================================== Severity: Medium Date : 2019-10-21 CVE-ID : CVE-2019-17596 Package : go-pie Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1051 Summary ======= The package go-pie before version...

Improper Key Verification

Overview Versions of openpgp prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The openpgp package does not...

Invalid Curve Attack

Overview Versions of openpgp prior to 4.3.0 are vulnerable to an Invalid Curve Attack. The package's implementation of ECDH fails to verify the validity of the communication partner's public key. The package calculates the resulting key secret based on an altered curve instead of the specified...

OPENSUSE-SU-2019:2007-1 Recommended update for dkgpg, libTMCG

This update for dkgpg, libTMCG fixes the following issues: libTMCG was updated to version 1.3.18 This release is two-fold: first, it fixes some bugs e.g. iterated S2K of the OpenPGP interface, and second, it adds functionality for handling v5 keys and signatures see RFC 4880bis-07. Update to...

Recommended update for dkgpg, libTMCG (moderate)

openSUSE Security Update: Recommended update for dkgpg, libTMCG Announcement ID: openSUSE-SU-2019:2007-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 An update that contains security fixes can now be installed. Description: This update fo...

GHSA-77JF-FJJF-XCWW Invalid Curve Attack in openpgp

Versions of openpgp prior to 4.3.0 are vulnerable to an Invalid Curve Attack. The package's implementation of ECDH fails to verify the validity of the communication partner's public key. The package calculates the resulting key secret based on an altered curve instead of the specified elliptic...

Invalid Curve Attack in openpgp

Versions of openpgp prior to 4.3.0 are vulnerable to an Invalid Curve Attack. The package's implementation of ECDH fails to verify the validity of the communication partner's public key. The package calculates the resulting key secret based on an altered curve instead of the specified elliptic...

GHSA-QWQC-28W3-FWW6 Message Signature Bypass in openpgp

Versions of openpgp prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type text. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input such as standalone or...

Message Signature Bypass in openpgp

Versions of openpgp prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type text. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input such as standalone or...

GHSA-HFMF-Q43V-2FFJ Improper Key Verification in openpgp

Versions of openpgp prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The openpgp package does not verify...

Improper Key Verification in openpgp

Versions of openpgp prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The openpgp package does not verify...

CVE-2019-9155

A cryptographic issue in OpenPGP.js =4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key...

CVE-2019-9153

CVE-2019-9153 affects OpenPGP.js: improper verification of cryptographic signatures in OpenPGP.js up to version 4.1.2 allows forging signed messages by substituting a standalone or timestamp signature. The issue is documented across multiple sources (NVD entry for CVE-2019-9153 and related adviso...

OPENSUSE-SU-2019:1951-1 Recommended update for dkgpg, libTMCG

This update for dkgpg, libTMCG fixes the following issues: libTMCG was updated to version 1.3.18 This release is two-fold: first, it fixes some bugs e.g. iterated S2K of the OpenPGP interface, and second, it adds functionality for handling v5 keys and signatures see RFC 4880bis-07. Update to...

Recommended update for dkgpg, libTMCG (moderate)

openSUSE Security Update: Recommended update for dkgpg, libTMCG Announcement ID: openSUSE-SU-2019:1951-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 An update that contains security fixes can now be installed. Description: This update for dkgpg, libTMCG...

NewStart CGSL MAIN 4.05 : gnutls Multiple Vulnerabilities (NS-SA-2019-0109)

The remote NewStart CGSL host, running version MAIN 4.05, has gnutls packages installed that are affected by multiple vulnerabilities: - Stack-based buffer overflow in the cdkpkgetkeyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have...

[SECURITY] Fedora 29 Update: gnupg2-2.2.17-1.fc29

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...