CVE-2020-11037

In Wagtail, a potential timing attack exists on pages or documents protected with a shared password via the Privacy controls. The password check uses a character-by-character comparison, enabling a timing analysis to potentially reveal the password when measured locally. Affected versions are bef...

CVE-2020-11037 Potential Observable Timing Discrepancy in Wagtail

In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is...

PT-2020-12505 · Wagtail · Wagtail

Name of the Vulnerable Software and Affected Versions: Wagtail versions prior to 2.7.3 Wagtail versions prior to 2.8.2 Description: A potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is...

Fedora 31 : openvpn (2020-e56f2deb30)

Update to latest upstream OpenVPN 2.4.9 release. It contains a security fix for CVE-2020-11810. This security issue is quite hard to abuse, requiring a fairly precise timing attack combined with guessing a just assigned peer-id reference. If successful, only a single client just initiating a new...

Timing Attack

jsrsasign is vulnerable to timing attack. A timing attack can be performed to discover the private key due to the usage of an unsafe method for ECDSA key generation and signing in the signHex function...

wolfSSL encryption issue vulnerability (CNVD-2020-22973)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in the wceccmulmodex of the ecc.c file in wolfSSL version 4.3.0. An attacker can exploit this...

CVE-2020-11713

wolfSSL 4.3.0 has mulmod code in wceccmulmodex in ecc.c that does not properly resist timing side-channel attacks...

CVE-2019-11743

Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history throu...

CVE-2019-9815

If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main...

CVE-2020-5725

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the login action with a crafted username and, through the use of timing attacks, can discover user passwords...

Arm Mbed TLS Information Disclosure Vulnerability

ARM mbed TLS is an SSL library. An information disclosure vulnerability exists in Arm Mbed TLS versions prior to 2.6.15. An attacker can exploit this vulnerability to obtain sensitive information RSA private key by monitoring cache usage during import...

DEBIAN-CVE-2020-10941

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information an RSA private key by measuring cache usage during an import...

GLSA-202003-32 : Libgcrypt: Side-channel attack

The remote host is affected by the vulnerability described in GLSA-202003-32 Libgcrypt: Side-channel attack A timing attack was found in the way ECCDSA was implemented in Libgcrypt. Impact : A local man-in-the-middle attacker, during signature generation, could possibly recover the private key...

Libgcrypt: Side-channel attack

Background Libgcrypt is a general purpose cryptographic library derived out of GnuPG. Description A timing attack was found in the way ECCDSA was implemented in Libgcrypt. Impact A local man-in-the-middle attacker, during signature generation, could possibly recover the private key. Workaround...

Timing Attack

antonioribeiro/google2fa is vulnerable to timing attacks. This vulnerability is possible because of the insecure usage of == during the user specified key comparison in verifyKey function in Google2FA.php which may lead to an information disclosure...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2018-0735, CVE-2018-0734, CVE-2018-5407)

Summary OpenSSL vulnerabilities were discllossed by the OpenSSL Project in October and November of 2018. IBM Spectrum Protect Plus uses OpenSSL and has addressed the applicable CVEs. 20 February 2020 - Changed fixing level from 10.1.5 to 10.1.5 patch1. 21 February 2020 - Provided link to 10.1.5...

HackerOne: GraphQL node interface for ActiveResource models lacks encoding for resource identifier, enabling parameter injection in Payments backend

HackerOne exposes a small number of ActiveResource objects through its GraphQL node interface. ActiveResource objects use HTTP as transport layer in order to fetch data. Four of these models, TaxForm, Payout, Payment, and PayoutPreference are fetched from an internal Payments backend system with ...

USN-4236-2: Libgcrypt vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN-4236-1 fixed a vulnerability in Libgcrypt. This update provides the corresponding fix for Ubuntu 16.04 LTS. Original advisory details: It was discovered that Libgcrypt was susceptible to a ECDSA timin...

USN-4236-1: Libgcrypt vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that Libgcrypt was susceptible to a ECDSA timing attack. An attacker could possibly use this attack to recover sensitive information. CVEs contained in this USN include: CVE-2019-13627...

CVE-2020-2101

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret...