The vulnerability of the Bind9 DNS-server implementation with the “--enable-native-pkcs11” option allows a attacker to cause a service failure.

The vulnerability of the Bind9 DNS-server implementation with the “--enable-native-pkcs11” option is related to the lack of a mechanism for managing privileges. Exploiting this vulnerability could allow an attacker to cause service failures by sending specially crafted DNS queries signed with an...

GHSA-537H-RV9Q-VVPH Python-RSA decryption of ciphertext leads to DoS

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

Python-RSA decryption of ciphertext leads to DoS

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

Cisco IOS XE Software IOx for Command Injection (cisco-sa-iox-cmdinj-RkSURGHG)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

[SECURITY] Fedora 33 Update: roca-detect-1.2.12-15.fc33

This tool is related to the ACM CCS 2017 conference paper 124 Return of the Coppersmith=EF=BF=BD=EF=BF=BD=EF=BF=BDs Attack: Practical Factorization of Widely Used RSA Moduli. https://crocs.fi.muni.cz/public/papers/rsaccs17 Install this to test public RSA keys for the presence of the vulnerability...

Fedora: Security Advisory for roca-detect (FEDORA-2021-acd448b558)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for roca-detect (FEDORA-2021-724c3aa51b)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2021-3955 · Unknown +2 · Mysql Server +3

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.2 Description: An issue was discovered in the Oauth extension for MediaWiki. The problem lies in MWOAuthConsumerSubmitControl.php, which does not ensure that the length of an RSA key will fit in a MySQL blob...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at the Australian Cyber Conference 2021 on March 17 and 18, 2021. I’m keynoting the all-virtual RSA Conference 2021, May 17-20, 2021. I’ll be speaking at an Informa event on September 14, 2021. Details to come. The lis...

PT-2021-6813

Name of the Vulnerable Software and Affected Versions Mbed TLS version 2.24.0 Description A side-channel vulnerability in base64 PEM file decoding exists, allowing system-level attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software runni...

Security Bulletin: IBM Watson OpenScale on Cloud Pak for Data is impacted by CVE-2020-25659

Summary IBM Watson OpenScale on Cloud Pak for Data has addressed CVE-2020-25659. Vulnerability Details CVEID: CVE-2020-25659 DESCRIPTION: python-cryptography could allow a remote attacker to obtain sensitive information, caused by a Bleichenbacher timing attack. By sending a specially-crafted...

Oracle Access Manager Webgate Information Disclosure (Oct 2020 CPU)

Binary data oracleaccessmanagerwebgatecve201811058.nbin...

NewStart CGSL MAIN 6.02 : nss Multiple Vulnerabilities (NS-SA-2021-0053)

The remote NewStart CGSL host, running version MAIN 6.02, has nss packages installed that are affected by multiple vulnerabilities: - Improper refcounting of soft token session objects could cause a use-after-free and crash likely limited to a denial of service. This vulnerability affects Firefox...

EulerOS Virtualization 3.0.6.6 : bind (EulerOS-SA-2021-1458)

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supported Preview...

Newest Intel Side-Channel Attack Sniffs Out Sensitive Data

Intel processors are vulnerable to a new side-channel attack, which researchers said can allow attackers to steal sensitive information such as encryption keys or passwords. Unlike previous side-channel attacks, this attack does not rely on sharing memory, cache sets and other former tactics...

OSV-2021-494 Heap-buffer-overflow in AK::ByteBuffer::overwrite

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31698 Crash type: Heap-buffer-overflow READ 1 Crash state: AK::ByteBuffer::overwrite Crypto::PK::RSA::parsersakey FuzzRSAKeyParsing.cpp...

No, RSA Is Not Broken

I have been seeing this paper by cryptographer Peter Schnorr making the rounds: "Fast Factoring Integers by SVP Algorithms." It describes a new factoring method, and its abstract ends with the provocative sentence: "This destroys the RSA cryptosystem." It does not. At best, its an improvement in...

Huawei EulerOS: Security Advisory for nss-softokn (EulerOS-SA-2021-1536)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2021-1458)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.6.0 : nss-softokn (EulerOS-SA-2021-1536)

According to the versions of the nss-softokn packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could...