Memory corruption

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

CVE-2020-13757

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

PYSEC-2020-99

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

UBUNTU-CVE-2020-13757

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

CVE-2020-13757

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

CVE-2020-13757

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

CVE-2020-13757

CVE-2020-13757 affects the Python-RSA package. Affected: Python-RSA before 4.1. Root cause: decryption ignores leading '\0' bytes in ciphertext. Impact stated in sources: potential DoS risk and information leakage indicators (e.g., attacker could infer usage, or ciphertext length could affect beh...

Open-Xchange: Missing (or redundant) null check in `dcrypt_openssl_sign`

Function dcryptopensslsign in file src/lib-dcrypt/dcrypt-openssl.c has the following code if EVPPKEYbaseidkey-key == EVPPKEYRSA errorr = "Format does not support RSA"; return FALSE; and later if md == NULL if errorr != NULL errorr = tstrdupprintf "Unknown digest %s", algorithm; return FALSE; So,...

PT-2020-13658 · Python +5 · Python-Rsa +5

Name of the Vulnerable Software and Affected Versions: Python-RSA versions prior to 4.1 Description: The issue concerns the decryption of ciphertext, where leading '0' bytes are ignored. This could potentially have security implications, such as helping an attacker infer that an application uses...

Huawei Data Communication: Weak Cryptography Vulnerability in Some Huawei Products (huawei-sa-20171222-01-cryptography)

Some Huawei products have a weak cryptography vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Huawei Data Communication: Weak Algorithm Vulnerability in Some Huawei Products (huawei-sa-20180704-01-algorithm)

There is a weak algorithm vulnerability in some Huawei products. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Huawei Data Communication: Cache Timing Vulnerability in OpenSSL RSA Key Generation (huawei-sa-20181212-01-cache)

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack CVE-2018-0737. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

DEBIAN-CVE-2020-13398

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds OOB write vulnerability has been detected in cryptorsacommon in libfreerdp/crypto/crypto.c...

Build support for open source in your organization

Have you ever stared at the same lines of code for hours only to have a coworker identify a bug after just a quick glance? That’s the power of community! Open source software development is guided by the philosophy that a diverse community will produce higher quality code by allowing anyone to...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2019 - Includes Oracle Oct 2019 CPU minus CVE-2019-2949

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 8 that are used by Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software. These issues were disclosed as part of the IBM Java SDK updates in Oct 2019...

BEC Gang Exploits G Suite, Long Domain Names in Cyberattacks

Business email compromise BEC attacks continue to be a thorn in companies’ sides, with the FBI in its IC3 annual cybercrime report saying that the attacks cost victims $1.7 billion in 2019. Making matters worse, BEC cybergangs are turning to new tactics and tricks to avoid detection and capitaliz...

Denial Of Service (DoS)

strongswan is vulnerable to denial of service DoS. The vulnerability exists as the gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted RSA signature...

Denial Of Service (DoS)

strongswan is vulnerable to denial of service DoS. The vulnerability exists as the gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpzpowmsec, which allows remote peers to cause a denial of service floating point exception and process crash via a...

EMC RSA Archer < 6.7.0.3 Multiple Vulnerabilities

The version of EMC RSA Archer running on the remote web server is prior to 6.7.0.3 6.7 P3, 6.6 P6 6.6.0.6 or 6.5 P7 6.5.0.7. It is, therefore, affected by multiple vulnerabilities: - RSA Archer, versions prior to 6.7 P3 6.7.0.3, contain an information exposure vulnerability. An authenticated...

Dell EMC RSA Archer Information Disclosure Vulnerability (CNVD-2020-31250)

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. An information disclosure vulnerability exists in versions prior to Dell...