Characterization-and-Detection-of-Cross-Router-Covert-Channels

Characterization and Detection of Cross-Router Covert Channels This repository contains the source code used in the paper "Characterization and Detection of Cross-Router Covert Channels". To access the paper, go to Dr. Oren's laboratory website: orenlab. The full data used in the paper is...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc (crlsa-2026_28208)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628208 advisory. postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison CVE-2026-6478 Tenable has extracted the preceding description bloc...

Rocky Linux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc (ALMALINUX9.6:CLSA-2026:1779697425)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779697425 advisory. - Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials...

AlmaLinux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc (ALMALINUX9.6:CLSA-2026:1779697425)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779697425 advisory. - Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all core modules. This...

Security Bulletin: Due to use bcprov-jdk18on-1.79.jar, IBM webMethods Integration Server is affected by multiple vulnerabilities.

Summary Multiple vulnerabilities were addressed in IBM webMethods Integration Server by upgrading the version of the Bouncy Castle BC-Java bcprov jar to 1.84.0 Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to credential exposure in PostgreSQL [CVE-2026-6478]

Summary IBM Watson Speech Services Cartridge is vulnerable to credential exposure in PostgreSQL, due to covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication which allows an attacker to recover user credentials sufficient to authenticate CVE-2026-6478. PostgreSQL...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099440)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099440 advisory. Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. Th...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099554)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099554 advisory. Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. Th...

Security Bulletin: IBM® Db2® federated server is affected by vulnerabilities in bcprov-jdk18on-1.82 and bcpkix-jdk18on-1.82.

Summary IBM® Db2® federated server is affected by vulnerabilities in bcprov-jdk18on-1.82 and bcpkix-jdk18on-1.82 Vulnerability Details CVEID:CVE-2026-5588 DESCRIPTION: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all pkix...

bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy ...

bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy ...

Security Bulletin:IBM Sterling Global Availability Mailbox uses bcprov-jdk15to18-1.78.1.jar, which is affected by CVE-2025-14813 and CVE-2026-5598, exposing the system to potential security risks including unauthorized access, denial of service.

Summary IBM Sterling Global Availability Mailbox uses bcprov-jdk15to18-1.78.1.jar, which is affected by CVE-2025-14813 and CVE-2026-5598, exposing the system to potential security risks including unauthorized access, denial of service, or remote code execution. Vulnerability Details...

Security Bulletin: Due to the use of Bouncy Castle Inc. BC-JAVA bcprov IBM webMethods Managed File Transfer is vulnerable to a Covert Timing Channel vulnerability and Use of a Broken or Risky Cryptographic Algorithm vulnerability

Summary Bouncy Castle Inc. BC-JAVA bcprov is used by IBM webMethods Managed File Transfer CVE-2025-14813, CVE-2026-5598, CVE-2026-0636 Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JA...

postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison

A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts...

Important: Red Hat Security Advisory: postgresql security update

An update for postgresql is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

RLSA-2026:27741 Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite...

postgresql security update

An update is available for postgresql. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PostgreSQL is an advanced object-relational database management system DBM...

RockyLinux 9 : postgresql (RLSA-2026:27741)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:27741 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq:...

MiracleLinux 9 : postgresql-13.23-3.el9_8 (AXSA:2026-1366:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1366:07 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libp...