qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

clone-cert

clone-cert.sh 这是一个简单的 shell 脚本，用于检索与 TLS 封装的 TCP 端口关联的 X.509 证书，并使用 openssl 通过替换公钥并修复签名来创建类似的证书。 如果你希望演示为什么自签名证书无法提供任何安全性，这将特别有用。当然，克隆证书的指纹会不同……但谁会手动检查自签名证书的指纹呢？ 你也可以克隆非自签名的证书。在这种情况下，序列号将被新生成的序列号替换（因为浏览器会记录遇到的序列号，并注意到异常情况），同时颁发者也会被更改（出于同样的原因）。伪造的颁发者会将第一个大写字母 O 替换为零，或者将小写字母 l 替换为大写字母...

CVE-2022-0778

CVE-2022-0778 该漏洞会在解析椭圆曲线密钥时触发 OpenSSL 中 BNmodsqrt 函数的无限循环。这意味着一个恶意构造的 X.509 证书可以对任何未修补的服务器发起 DoS 攻击。 漏洞的核心在于解析以压缩格式表示点的 EC 密钥过程中：在解析此类密钥时，OpenSSL 会尝试扩展压缩点，试图计算曲线定义素数 p 的模平方根。然而，p 的素性未在任何地方检查，即使在需要它的 BNmodsqrt 中也不例外；因此，由于 p 不是预期的素数，实现中的一个错误会导致无限循环。 中文版说明可以见我的博客OpenSSL CVE-2022-0778漏洞问题复现与非法证书构造 致...

CVE-2026-6789-Stack-Buffer-Overflow-in-Embedded-TLS-Certificate-Parser

9. CVE-2026-6789 – 嵌入式 TLS 证书解析器中的堆栈缓冲区溢出 概述 一个流行的轻量级 TLS 库（模拟）在解析带有精心构造的长度字段的 X.509 证书主体备用名称扩展时，存在堆栈缓冲区溢出。 严重性： 严重（在物联网/工业设备上可实现远程代码执行） 存在漏洞的 C 解析器与利用 // tlsx509vuln.c include include include include // Vulnerable certificate parser struct cert uint8t data; sizet len; ; int...

CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

Rocky Linux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1785496521)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785496521 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

Rocky Linux 8 [CIQ] Security Update: libreswan / libreswan-debuginfo / libreswan-debugsource Multiple Vulnerabilities (crlsa-2026_46396)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202646396 advisory. librenswan: IKEv1 Denial of Service via RSA-SHA1 PKCS1 Version 1.5 Encrypted authentication payload CVE-2026-50721 librenswan: IKEv2 Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_7013)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227013 advisory. OpenJDK: improper MultiByte conversion can lead to buffer overflow JGSS, 8286077 CVE-2022-21618 OpenJDK: excessive memory allocation in X.509 certificate...

AlmaLinux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1785496521)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785496521 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

Rocky Linux 10.2 [CIQ] Security Update: libreswan / libreswan-debugsource / libreswan-minimal / etc Multiple Vulnerabilities (crlsa-2026_46398)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202646398 advisory. librenswan: IKEv1 Denial of Service via RSA-SHA1 PKCS1 Version 1.5 Encrypted authentication payload CVE-2026-50721 librenswan: IKEv2 Denial of Service...

CentOS Linux 7 [TuxCare] Security Update: openssl11 / openssl11-devel / openssl11-libs / openssl11-static Multiple Vulnerabilities (CENTOS7:CLSA-2026:1780683040)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1780683040 advisory. - In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application wi...

Rocky Linux 9 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_7007)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227007 advisory. OpenJDK: excessive memory allocation in X.509 certificate parsing Security, 8286533 CVE-2022-21626 OpenJDK: HttpServer no connection count limit Lightweigh...

Rocky Linux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl (ALMALINUX9.6:CLSA-2026:1788860468)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788860468 advisory. - Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the...

Rocky Linux 9 [CIQ] Security Update: libreswan / libreswan-debuginfo / libreswan-debugsource Multiple Vulnerabilities (crlsa-2026_46397)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202646397 advisory. librenswan: IKEv1 Denial of Service via RSA-SHA1 PKCS1 Version 1.5 Encrypted authentication payload CVE-2026-50721 librenswan: IKEv2 Denial of Service via...

Linux Distros Unpatched Vulnerability : CVE-2026-95616

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an...

CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

DEBIAN-CVE-2026-95616

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

CVE-2026-95616 Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

CVE-2026-95616 Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

CVE-2026-95616

Apache WSS4J is vulnerable to an integer overflow in its DER bounds check, which allows an oversized allocation to bypass validation. An unauthenticated attacker can exploit this by sending a SOAP message containing an X.509 certificate where the SubjectKeyIdentifier extension declares a length o...