Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to use of P256 certificates. An attacker can evade blocklist enforcement by exploiting ECDSA signature malleability to generate a certificate with a different fingerprint, allowing us...

EUVD-2020-6103

Malware in sbrugna...

`Slip10Like` derivation method instantiated with certain curves may allow attacker to find derivation path which results into very long derivation (possible DoS)

Impact Impacted are the only ones who use hdwallet::Slip10Like or slip10 derivation method instantiated with curves other than secp256k1 and secp256r1. hdwallet crate used to provide Slip10Like derivation method, which is also provided in slip-10 crate as a default derivation method. It's based o...

PT-2024-40022

Name of the Vulnerable Software and Affected Versions hd wallet versions prior to 0.6.0 slip 10 versions prior to 0.6.0 note: slip 10 version 0.4 is mentioned, but it is not clear if versions after 0.4 and before 0.6 are affected, assuming 0.6 is the fixed version for slip 10 as well Description...

wolfssl:cryptofuzz-normal-math: Use-of-uninitialized-value in Botan::IntMod<Botan::PCurve::Secp256r1Rep<Botan::EllipticCurve<Botan::PCurve::se

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5851619005104128 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-normal-math Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

GHSA-79RC-JJH6-RC89 PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

Impact The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is secp384r1. Using any other cur...

PT-2023-32987

Name of the Vulnerable Software and Affected Versions Minecraft: Bedrock Edition versions prior to 4.23.1 Minecraft: Bedrock Edition versions prior to 5.3.1 Description The issue arises from the server's use of ECDH to calculate a shared secret for symmetric encryption key used to encrypt network...

Design/Logic Flaw

Crypt::Perl::ECDSA in the Crypt::Perl aka p5-Crypt-Perl module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 prime256v1. This could conceivably have a security-relevant impact if an attacker wishes ...

CVE-2020-13895

Crypt::Perl::ECDSA in the Crypt::Perl aka p5-Crypt-Perl module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 prime256v1. This could conceivably have a security-relevant impact if an attacker wishes ...

CVE-2020-13895: Improper Verification of Cryptographic Signature

Crypt::Perl::ECDSA in the Crypt::Perl aka p5-Crypt-Perl module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 prime256v1. This could conceivably have a security-relevant impact if an attacker wishes ...

PT-2020-13760

Name of the Vulnerable Software and Affected Versions Crypt::Perl versions prior to 0.32 Description The issue is related to the verification of ECDSA signatures. Specifically, when using the curve secp256r1 prime256v1, the verification may fail when r and s are small and when s equals 1. This...

nettle security and bug fix update

2.7.1-8 - Use a cache-silent version of mpzpowm to prevent cache-timing attacks against RSA and DSA in shared VMs. 1364897,CVE-2016-6489 2.7.1-5 - Fixed SHA-3 implementation to conform to final standard 1252936 - Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues in secp256r1 and...