GHSA-X5H4-9GQW-942J Improper Verification of Cryptographic Signature in aws-encryption-sdk

Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-java

Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth...

GHSA-55XH-53M6-936R Improper Verification of Cryptographic Signature in aws-encryption-sdk-java

Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth...

PT-2021-24401

Name of the Vulnerable Software and Affected Versions: Encryption SDK versions prior to 1.9 Encryption SDK versions prior to 2.2 Description: This issue concerns the Encryption SDK's handling of streaming signed messages and restricting processing of certain types of invalid messages. The SDK...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-java

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages...

PT-2021-24471

Name of the Vulnerable Software and Affected Versions: Encryption SDK versions prior to 1.9 Encryption SDK versions prior to 2.2 Description: This issue affects the Encryption SDK, which supports a streaming mode for signed messages. The SDK uses AES-GCM encryption and verifies plaintext before...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated...

PT-2021-24353

Name of the Vulnerable Software and Affected Versions: AWS Encryption SDK for Java versions 2.0.0 through 2.2.0 AWS Encryption SDK for Java versions less than 1.9.0 Description: The issue concerns the incorrect validation of some invalid ECDSA signatures. This affects the integrity of the...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the...

PT-2021-24426

Name of the Vulnerable Software and Affected Versions: Encryption SDK versions prior to 1.9 Encryption SDK versions prior to 2.2 Description: This issue concerns the Encryption SDK's handling of streaming signed messages and restricting processing of certain types of invalid messages. The SDK...

CWE-379 in fabric-sdk-rest version All released versions (project is now archived)

In Hyperledger fabric-sdk-rest version All released versions project is now archived a CWE-379 exists in the packages/fabric-rest/fabric-rest-server script that can be attacked via Local resulting in File overwrite from a privileged user...

GSD-2021-1000003 CWE-379 in fabric-sdk-rest version All released versions (project is now archived)

In Hyperledger fabric-sdk-rest version All released versions project is now archived a CWE-379 exists in the packages/fabric-rest/fabric-rest-server script that can be attacked via Local resulting in File overwrite from a privileged user...

dotnet5.0 security and bugfix update

5.0.203-1.0.1 - Add support for new Oracle release 5.0.203-1 - Update to .NET SDK 5.0.203 and Runtime 5.0.6 - Resolves: RHBZ1954328 5.0.202-1 - Update to .NET SDK 5.0.202 and Runtime 5.0.5 - Resolves: RHBZ1947662...

dotnet3.1 security and bugfix update

3.1.115-1.0.1 - Update patch to support 8.3 [email protected] - support OL release scheme [email protected] 3.1.115-1 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ1954333 3.1.114-2 - Rebuild to tag into the correct location - Resolves: RHBZ1947455...

Security Bulletin: CVE-2021-2161 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2021-2161 was disclosed in the Oracle April 2021 Critical Patch Update. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, high...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect WebSphere Service Registry and Repository April 2021 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, used by WebSphere Service Registry and Repository. These issues were disclosed as part of the IBM Java SDK updates in April 2021. These issues are addressed by WebSphere Application Server shipped with WebSphere...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Application Server April 2021 CPU that is bundled with IBM WebSphere Application Server Patterns

Summary There are multiple vulnerabilities in the IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the IBM Java SDK updates in April 2021. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server shipped with IBM Security Identity Manager

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Identity Manager ISIM. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

[ASA-202105-23] dotnet-sdk-3.1: privilege escalation

Arch Linux Security Advisory ASA-202105-23 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-sdk-3.1 Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1945 Summary ======= The package dotnet-sdk-3...

[ASA-202105-20] dotnet-sdk: privilege escalation

Arch Linux Security Advisory ASA-202105-20 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-sdk Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1944 Summary ======= The package dotnet-sdk befor...