VulnCheck KEV: CVE-2021-38153

Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been...

RLSA-2023:1569 Moderate: gnutls security and bug fix update

The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fixes: gnutls: timing side-channel in the TLS RSA key exchange code CVE-2023-0361 For more details about the security issues,...

Timing Attack

github.com/hashicorp/vault is vulnerable to Timing Attacks. The vulnerability exists in mult and div functions of shamir.go because of not implementing a constant time which allows an attacker to observe a large number of unseal operations on the host...

Rocky Linux 8 : gnutls (RLSA-2023:1569)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:1569 advisory. - A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key...

gnutls: timing side-channel in the TLS RSA key exchange code

A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side-channel may be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, the attacker would need to send ...

RHEL 8 : gnutls (RHSA-2023:1569)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1569 advisory. The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS...

The vulnerability of the Resource Timing application programming interface in Google Chrome and Microsoft Edge browsers allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Resource Timing application programming interface in Google Chrome and Microsoft Edge browsers is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected informati...

Moderate: gnutls security and bug fix update

The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fixes: gnutls: timing side-channel in the TLS RSA key exchange code CVE-2023-0361 For more details about the security issues,...

Oracle Linux 8 : gnutls (ELSA-2023-1569)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-1569 advisory. 3.6.16-6 - Fix x8664 CPU feature detection when AVX is not available 2131152 - Fix timing side-channel in TLS RSA key exchange 2162598 Tenable has extracted the...

The vulnerability of the Resource Timing application programming interface in Google Chrome and Microsoft Edge browsers allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Resource Timing application programming interface in Google Chrome and Microsoft Edge browsers is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Security Bulletin: IBM Aspera Faspex 5.0.5 has addressed CVE-2022-4304

Summary This Security Bulletin addresses OpenSSL CVE-2022-4304 where an attacker could obtain sensitve nformation, caused by a timing-based side channel in the RSA Decryption implementation. Vulnerability Details CVEID:CVE-2022-4304 DESCRIPTION: OpenSSL could allow a remote attacker to obtain...

The vulnerability of the Linux operating system’s kernel power management function allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Linux operating system’s kernel power management function relates to the use of hidden time channels for data transmission during the processing of model-specific registers MSRs. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...

frankfurt-tria.r.mikatiming.de Cross Site Scripting vulnerability OBB-3244613

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CLSA-2023-1680210075 openssl: Fix of 2 CVEs

CVE-2022-4304: fix timing based side channel in RSA decryption - CVE-2022-4450: avoid dangling pointers in PEMreadbioex...

CLSA-2023-1680206329 openssl: Fix of 2 CVEs

CVE-2022-4304: fix timing based side channel in RSA decryption - CVE-2022-4450: avoid dangling pointers in PEMreadbioex...

GHSA-VQ4H-9GHM-QMRR HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a...

HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a...

CVE-2023-25000

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a...

Denial of service

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a...

CVE-2023-25000 Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a...