29 matches found
Inadequate Encryption Strength
github.com/cloudflare/gokey is vulnerable to Inadequate Encryption Strength. The vulnerability is due to flawed seed decryption logic that uses only limited entropy from the initialization vector and authentication tag, which allows an attacker with access to the seed file to derive generated...
GO-2025-4174 gokey allows secret recovery from a seed file without the master password in github.com/cloudflare/gokey
gokey allows secret recovery from a seed file without the master password in github.com/cloudflare/gokey...
GHSA-69JW-4JJ8-FCXM gokey allows secret recovery from a seed file without the master password
In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...
Inadequate Encryption Strength
Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength due to a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. An attacker can recover all...
CVE-2025-13353
In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...
UBUNTU-CVE-2025-13353
In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...
CVE-2025-13353
The CVE-2025-13353 issue affects gokey versions prior to 0.2.0, where a flaw in the seed decryption logic caused passwords/secrets derived from a seed file to be generated from only 28 bytes of entropy (instead of using the full seed, 240 bytes). This allowed a malicious actor with just the seed ...
CVE-2025-13353 gokey allows secret recovery from a seed file without the master password
In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...
CVE-2025-13353 gokey allows secret recovery from a seed file without the master password
In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...
EUVD-2025-200219
In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...
PT-2025-48664
Name of the Vulnerable Software and Affected Versions gokey versions prior to 0.2.0 Description A flaw in the seed decryption logic caused passwords to be incorrectly derived using only a portion of the expected entropy when generating keys/secrets from a seed file. This resulted in potentially...
EUVD-2006-0360
Malware in sbrugna...
EUVD-2018-3090
Malware in sbrugna...
Transmission Resource Management Error Vulnerability
Transmission is an open source BitTorrent client application. The program mainly provides features such as file downloads. A resource management error vulnerability exists in the libtransmission/variant.c file in Transmission versions prior to 3.00, which can be exploited by remote attackers to...
Design/Logic Flaw
Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator LRNG seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the...
CVE-2018-11045
Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator LRNG seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the...
CVE-2018-11045: Use of Insufficiently Random Values
Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator LRNG seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the...
PT-2018-10265
Name of the Vulnerable Software and Affected Versions Pivotal Operations Manager versions 2.1 prior to 2.1.6 Pivotal Operations Manager versions 2.0 prior to 2.0.15 Pivotal Operations Manager versions 1.12 prior to 1.12.22 Description The issue concerns a static Linux Random Number Generator LRNG...
UBUNTU-CVE-2014-3563
Multiple unspecified vulnerabilities in Salt aka SaltStack before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in 1 seed.py, 2 salt-ssh, or 3 salt-cloud...
PYSEC-2014-18
Multiple unspecified vulnerabilities in Salt aka SaltStack before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in 1 seed.py, 2 salt-ssh, or 3 salt-cloud...