197 matches found
MGASA-2025-0065 Updated golang packages fix security vulnerability
Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec. CVE-2025-22866...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.23 (SUSE-SU-2025:0393-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0393-1 advisory. - CVE-2025-22866: Fixed timing sidechannel for P-256 on ppc64le bsc1236801. Bug fixes: - go1.23 release...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.22 (SUSE-SU-2025:0392-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0392-1 advisory. - CVE-2025-22866: Fixed timing sidechannel for P-256 on ppc64le bsc1236801. Bug fixes: - go1.22 release...
SUSE-SU-2025:0431-1 Security update for go1.24
This update for go1.24 fixes the following issues: - CVE-2025-22866: Fixed timing sidechannel for P-256 on ppc64le bsc1236801. - CVE-2025-22867: Fixed arbitrary code execution during build on darwin bsc1236839. Other fixes: - go1.2r42 release tracking bsc1236217...
Security update for go1.23
This update for go1.23 fixes the following issues: CVE-2025-22866: Fixed timing sidechannel for P-256 on ppc64le bsc1236801. Bug fixes: go1.23 release tracking bsc1229122 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zyppe...
SUSE-SU-2025:0393-1 Security update for go1.23
This update for go1.23 fixes the following issues: - CVE-2025-22866: Fixed timing sidechannel for P-256 on ppc64le bsc1236801. Bug fixes: - go1.23 release tracking bsc1229122...
CVE-2025-22866 Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private...
CVE-2025-22866
CVE-2025-22866 : The initial record notes leakage of a small number of secret scalar bits on the ppc64le architecture caused by a variable-time instruction in an internal function’s assembly. The document states this leakage is not believed to enable private-key recovery when using P-256 in any w...
CVE-2025-22866 Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private...
GO-2025-3447 Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private...
UBUNTU-CVE-2024-56738
GNU GRUB aka GRUB2 through 2.12 does not use a constant-time algorithm for grubcryptomemcmp and thus allows side-channel attacks...
Security Bulletin: IBM Technical Support Appliance - possible exposure of sensitive information
Summary RSA-PSK key exchange occurs when establishing a connection from a web browser to the IBM Technical Support Appliance web UI. Vulnerability Details CVEID:CVE-2023-5981 DESCRIPTION: GNU GnuTLS could allow a remote attacker to obtain sensitive information, caused by a timing sidechannel issu...
Security Bulletin: IBM MQ Appliance is vulnerable to exposure of sensitive information (CVE-2023-5981 and CVE-2024-0533)
Summary IBM MQ Appliance has addressed GNU GnuTLS exposure of sensitive information vulnerabilities. Vulnerability Details CVEID:CVE-2023-5981 DESCRIPTION: GNU GnuTLS could allow a remote attacker to obtain sensitive information, caused by a timing sidechannel issue during RSA-PSK key exchange. B...
Security Bulletin: IBM Storage Ceph is vulnerable to an Observable Discrepancy in the RHEL UBI (CVE-2023-5981)
Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. CVE-2023-5981. Vulnerability Details CVEID:CVE-2023-5981 DESCRIPTION: GNU GnuTLS could allow a remote attacker to obtain sensitive...
RUSTSEC-2024-0333 `rsa-export` is unmaintained
This crate has been deprecated in favour of using the native support for exporting RSA keys into the standard PEM format. See docs.rs documentation. In addition to that, the operations in this crate arithmetic and Base64 encoding are not done in constant-time, potentially exposing the user to...
CVE-2023-51392
Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks...
Hardcoded credentials
Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks...
CVE-2023-51392 Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM
Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks...
CVE-2023-51392
Summary: CVE-2023-51392 affects Silicon Labs EmberZNet v7.2.0–v7.4.0 where software AES-CCM is used instead of hardware-accelerated cryptography, potentially enabling side-channel risks (electromagnetic and differential power analysis). The connected sources specify Ember ZNet and related advisor...