[SECURITY] Fedora 40 Update: java-scrypt-1.4.0-24.fc40

A pure Java implementation of the scrypt key derivation function...

Timing Attacks

github.com/agnivade/easy-scrypt is vulnerable to Timing Attacks. The vulnerability exists because the VerifyPassphrase function of scrypt.go does not compare hashes in constant time, allowing an attacker to progressively use the timing of the request to identify a valid hash...

easy-scrypt Observable Timing Discrepancy vulnerability

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. Upgrading to version 1.0.0 can address this issue. The name of the patch is...

GHSA-R894-5R7V-7RX3 easy-scrypt Observable Timing Discrepancy vulnerability

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. Upgrading to version 1.0.0 can address this issue. The name of the patch is...

CVE-2014-125055

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult...

Design/Logic Flaw

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult...

CVE-2014-125055

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult...

CVE-2014-125055 agnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancy

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult...

CVE-2014-125055

The CVE concerns the Go library agnivade/easy-scrypt. Affected is the VerifyPassphrase function in scrypt.go, where an observable timing discrepancy is introduced due to the underlying implementation flaw. Per multiple sources, upgrading to version 1.0.0 fixes the issue (patch: 477c10cf3b144ddf96...

agnivade easy-scrypt 安全漏洞

easy-scrypt is a primitive scrypt library available in Go by Agniva De Sarker's personal developer. A security vulnerability exists in agnivade easy-scrypt. An attacker has exploited the vulnerability to cause observable time discrepancies...

CVE-2014-125055: Observable Timing Discrepancy

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult...

Observable Timing Discrepancy

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is...

@codingsh/harmony-crypto (>=0.1.57, <=0.1.58) potentially affected by unknown CVE via scrypt-shim (0.0.1-security)

scrypt-shim NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on scrypt-shim and may be impacted: - @codingsh/harmony-crypto =0.1.57, =0.1.58 Source cves: unknown CVE Source advisory: OSV:MAL-2022-5972...

Malicious code in scrypt-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d35f2999053c0d8b7abe3dc46b17ee7c41b309ed661021067496ee77e569f923 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5972 Malicious code in scrypt-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d35f2999053c0d8b7abe3dc46b17ee7c41b309ed661021067496ee77e569f923 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2016-20013

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service CPU consumption because the algorithm's runtime is proportional to the square of the length of the password...

AES256_Passwd_Store - Secure Open-Source Password Manager

This script securely encrypts or decrypts passwords on disk within a custom database file. It also features functionality to retrieve passwords from a previously generated database file. This script takes a master password from stdin/from memory, then hashes the password using the specified hashi...

Facebook HHVM Denial of Service Vulnerability

Facebook HHVM aka HipHop Virtual Machine is a virtual machine from Facebook that significantly improves the performance of loading dynamic pages in PHP. A security vulnerability exists in the call to the 'scryptenc' function in Facebook HHVM. The vulnerability can be exploited by an attacker with...

UBUNTU-CVE-2019-3570

Call to the scryptenc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r and p. This happens if the parameters are configurable by an attacker for instance by providing the output of scryptenc in a context where Hack/PHP code would attempt to verify it by...

PT-2019-16618

Name of the Vulnerable Software and Affected Versions HHVM versions 3.30.5 and below HHVM versions 4.0 through 4.2 HHVM versions 4.3.0 through 4.8.0 Description A call to the scrypt enc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r, and p. This occurs...