280 matches found
OpenSSL DSA Design Vulnerability
OpenSSL is the OpenSSL team developed an open source capable of implementing the Secure Sockets Layer SSL v2/v3 and Secure Transport Layer TLS v1 protocols of the general cryptographic library, which supports a variety of cryptographic algorithms , including symmetric ciphers , hash algorithms ,...
Botan Downgrade Vulnerability
Botan is a C++ library of cryptographic algorithms that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A degradation vulnerability exists in Botan versions 1.11.x prior to 1.11.29, which stems from the program's failure to enforce a TLS policy on the signature algorithm and the ECC ellipt...
Botan ECDSA Bypass Attack Vulnerability
Botan is a C++ library of cryptographic algorithms that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A security vulnerability exists in Botan that allows remote attackers to exploit the vulnerability to perform a bypass attack on ECDSA...
OpenJDK: insufficient DSA key parameters checks (Security, 8138593)
It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected...
OpenSSL: Double-free in DSA code
A double-free flaw was found in the way OpenSSL parsed certain malformed DSA Digital Signature Algorithm private keys. An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash...
PT-2016-1332
Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.1 through 1.0.1s OpenSSL versions 1.0.2 through 1.0.2g MySQL Server versions 5.6.29 and earlier MySQL Server versions 5.7.11 and earlier Description A double free vulnerability in the dsa priv decode function in...
Updated gnutls packages fix security vulnerabilities
It was reported that GnuTLS does not check whether the two signature algorithms match on certificate import CVE-2015-0294. Kurt Roeckx discovered that decoding a specific certificate with very long DistinguishedName DN entries leads to double free. A remote attacker can take advantage of this fla...
MGASA-2015-0322 Updated gnutls packages fix security vulnerabilities
It was reported that GnuTLS does not check whether the two signature algorithms match on certificate import CVE-2015-0294. Kurt Roeckx discovered that decoding a specific certificate with very long DistinguishedName DN entries leads to double free. A remote attacker can take advantage of this fla...
NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)
A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks...
Updated libcryptopp package fixes security vulnerability
Evgeny Sidorov discovered that libcryptopp did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow remote attackers to mount a timing attack and retrieve the user's private key CVE-2015-2141...
Amazon Linux AMI : gnutls (ALAS-2015-575)
It was found that GnuTLS did not check activation and expiration dates of CA certificates. This could cause an application using GnuTLS to incorrectly accept a certificate as valid when its issuing CA is already expired. CVE-2014-8155 It was found that GnuTLS did not verify whether a hashing...
gnutls: certificate algorithm consistency checking issue
It was discovered that GnuTLS did not check if all sections of X.509 certificates indicate the same signature algorithm. This flaw, in combination with a different flaw, could possibly lead to a bypass of the certificate signature check...
openSUSE Security Update : libcryptopp (openSUSE-2015-504)
libcryptopp was updated to fix one security issue. This security issue was fixed : - CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 did not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allowed...
CVE-2015-2141
libcrypt++ 5.6.2 contains a timing-attack vulnerability in InvertibleRWFunction::CalculateInverse used with Rabin–Williams signatures, enabling remote extraction of private keys. Affected component is the private-key blinding during Rabin–Williams operations; impact is private-key disclosure unde...
OpenJDK: insufficient hardening of RSA-CRT implementation (JCE, 8071726)
It was found that the RSA implementation in the JCE component in OpenJDK did not follow recommended practices for implementing RSA signatures...
Debian DLA-180-1 : gnutls26 security update
Multiple vulnerabilities have been discovered in GnuTLS, a library implementing the TLS and SSL protocols. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2014-8155 Missing date/time checks on CA certificates CVE-2015-0282 GnuTLS does not verify the RSA PK...
Code injection
GnuTLS before 3.1.0 does not verify that the RSA PKCS 1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors...
CVE-2015-0282
GnuTLS before 3.1.0 does not verify that the RSA PKCS#1 signature algorithm matches the signature algorithm in the certificate, enabling remote downgrade attacks via unspecified vectors. Impact is downgrade/traffic manipulation risk with affected deployments. The CVE entry explicitly targets GnuTLS...
USN-2540-1 gnutls26, gnutls28 vulnerabilities
It was discovered that GnuTLS did not perform date and time checks on CA certificates, contrary to expectations. This issue only affected Ubuntu 10.04 LTS. CVE-2014-8155 Nikos Mavrogiannopoulos discovered that GnuTLS incorrectly verified that signature algorithms matched. A remote attacker could...