CVE-2021-27378

An issue was discovered in the randcore crate before 0.6.2 for Rust. Because readu32into and readu64into mishandle certain buffer-length checks, a random number generator may be seeded with too little data...

CVE-2021-27378

An issue was discovered in the randcore crate before 0.6.2 for Rust. Because readu32into and readu64into mishandle certain buffer-length checks, a random number generator may be seeded with too little data...

RUSTSEC-2021-0023 Incorrect check on buffer length when seeding RNGs

Summary: randcore::le::readu32into and readu64into have incorrect checks on the source buffer length, allowing the destination buffer to be under-filled. Implications: some downstream RNGs, including Hc128Rng but not the more widely used ChaChaRng, allow seeding using the SeedableRng::fromseed...

Incorrect check on buffer length when seeding RNGs

Summary: randcore::le::readu32into and readu64into have incorrect checks on the source buffer length, allowing the destination buffer to be under-filled. Implications: some downstream RNGs, including Hc128Rng but not the more widely used ChaChaRng, allow seeding using the SeedableRng::fromseed...

PT-2021-17424

Name of the Vulnerable Software and Affected Versions rand core crate versions prior to 0.6.2 Description An issue was discovered in the rand core crate where the functions read u32 into and read u64 into mishandle certain buffer-length checks. This can cause a random number generator to be seede...

SUSE SLES15 Security Update : stunnel (SUSE-SU-2021:0194-1)

This update for stunnel fixes the following issues : Security issue fixed : The 'redirect' option was fixed to properly handle 'verifyChain = yes' bsc1177580. Non-security issues fixed : Fix startup problem of the stunnel daemon bsc1178533 update to 5.57 : - Security bugfixes - New features - New...

Defending the power grid against supply chain attacks—Part 1: The risk defined

Most people don’t think about electricity. If the internet works, their food is refrigerated, and their debit card is approved, why should they? Its ubiquity and reliability render it invisible—a bit of magic that powers much of modern life. That is, until a large storm passes through. Localized...

Guarding against supply chain attacks—Part 2: Hardware risks

The challenge and benefit of technology today is that it’s entirely global in nature. This reality is brought into focus when companies assess their supply chains, and look for ways to identify, assess, and manage risks across the supply chain of an enterprise. Part 2 of the “Guarding against...

Youzer - Fake User Generator For Active Directory Environments

Fake User Generator for Active Directory Environments Introduction The goal of Youzer is to create information rich Active Directory environments. This uses the python3 library 'faker' to generate random accounts. pip3 install faker You can either supply a wordlist or have the passwords generated...

Design/Logic Flaw

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

Can't delete replica when it is being processed.

Challenge Replication job fails with error: Can't delete replica when it is being processed. Cause If a replication job failed before the replica VM is fully created, the job may fail attempting to delete the VM as part of an undo operation on the failed run. Solution This issue can generally be...

Backup Copy Seeding and Mapping for Cloud Connect

Objective This article documents how to seed a Backup Copy job for use with a Cloud Repository from a Veeam Cloud Service Provider. Solution Critical Notes Starting with Veeam Backup & Replication v10, there are now two different backup copy modes: Immediate copy and Periodic copy. The mode used ...

CVE-2016-10180

An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srandtime0 seeding...

Design/Logic Flaw

An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srandtime0 seeding...

CVE-2016-10180

An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srandtime0 seeding...

How to Map Replicas in Cloud Connect

Purpose This KB article documents the procedure for mapping a replication job to a replica that was not created by a tenant's replication job. Cause Use case examples: The tenant has sent backup files to the Service Provider, and the Service Provider restores the VMs from the backup files to crea...

USN-3010-1 expat vulnerabilities

It was discovered that Expat unexpectedly called srand in certain circumstances. This could reduce the security of calling applications. CVE-2012-6702 It was discovered that Expat incorrectly handled seeding the random number generator. A remote attacker could possibly use this issue to cause a...

SUSE-SU-2016:1528-1 Security update for openssh

openssh was updated to fix three security issues. These security issues were fixed: - CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to...

OracleVM 3.2 : openssh (OVMSA-2016-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - change default value of MaxStartups - CVE-2010-5107 John Haxby - improve RNG seeding from /dev/random 681291,708056 - make ssh1's ConnectTimeout option apply to both the TCP connection and SSH banner...

How to Perform a Manual Failback (Reverse Replication)

Article Applicability This article is relevant only to non-CDP snapshot-based replicas. Reverse replication cannot be used to fail back a CDP replica. To fail back a CDP replica, use the built-in failback workflow described in Failover and Failback for CDP. Purpose This article describes how to...