CVE-2023-49092 RustCrypto/RSA vulnerable to a Marvin Attack via key recovery through timing sidechannels

RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is...

CVE-2023-49092 RustCrypto/RSA vulnerable to a Marvin Attack via key recovery through timing sidechannels

RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is...

CVE-2023-49092 RustCrypto/RSA vulnerable to a Marvin Attack via key recovery through timing sidechannels

RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is...

CVE-2023-49092

The CVE-2023-49092 entry concerns RustCrypto/RSA, a pure Rust portable RSA implementation. The root cause is a non-constant-time implementation that leaks information about the private key through timing observations over the network. Practical impact is key recovery by an attacker who can observ...

kernel: use-after-free due to race condition occurring in dvb_net.c

A race condition flaw leading to a use-after-free issue was found in the Linux kernel media subsystem in the dvbnet component of the DVB core device driver. It could occur between the time the device is disconnected .disconnect function and the time the device node is opened dvbdeviceopen functio...

ALPINE-CVE-2023-5981

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding...

DEBIAN-CVE-2023-5981

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding...

AZL-32048 CVE-2023-5981 affecting package gnutls for versions less than 3.7.11-1

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding...

CVE-2023-5981 Gnutls: timing side-channel in the rsa-psk authentication

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding...

Rust Security Vulnerabilities

Rust is a general-purpose, compiled programming language from the Mozilla Foundation in the United States. A security vulnerability exists in Rust RustCrypto RSA, which stems from the disclosure of timing information where information about private keys can be observed over the network...

Mozilla: Clickjacking permission prompts using the fullscreen transition

The Mozilla Foundation Security Advisory describes this flaw as: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant butto...

Debian: Security Advisory (DLA-3660-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GnuTLS Security Vulnerabilities

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols. A security vulnerability exists in GnuTLS version 3.6.7-4+deb10u11, which stems from a security flaw in the RSA-PSK ClientKeyExchange, where the response time to a misformatted ciphertext differs from the...

[SECURITY] [DLA 3660-1] gnutls28 security update

Debian LTS Advisory DLA-3660-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 22, 2023 https://wiki.debian.org/LTS Package : gnutls28 Version : 3.6.7-4+deb10u11 CVE ID : CVE-2023-5981 Debian Bug : 1056188 A vulnerability was found in GnuTLS, a secure...

Design/Logic Flaw

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could...

CVE-2023-20084

CVE-2023-20084 affects Cisco Secure Endpoint for Windows. A timing issue between software components can let a local, authenticated attacker coerce a user to place a malicious file in a folder and run it within a narrow window, causing the endpoint to fail to quarantine the file or terminate the ...

CVE-2023-20084

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could...

Marvin Attack: potential key recovery through timing sidechannels

Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. Patches No patch is yet available, however work is underway to migrate...

RUSTSEC-2023-0071 Marvin Attack: potential key recovery through timing sidechannels

Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. Patches No patch is yet available, however work is underway to migrate...

Cisco Secure Endpoint Security Vulnerability

Cisco Secure Endpoint Cisco AMP for Endpoints is an endpoint application from Cisco that integrates static and dynamic malware analysis and threat intelligence. A security vulnerability exists in Cisco Secure Endpoint for Windows that stems from a timing issue between various software components,...