roca

ROCA detection tool This tool is related to ACM CCS 2017 conference paper 124 Return of the Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli. It enables you to test public RSA keys for a presence of the described vulnerability. Update 4.11.2017 : Python 2.7, 3.4+ supported...

roca

ROCA检测工具 该工具与ACM CCS 2017会议论文第124号《Coppersmith攻击归来：广泛使用的RSA模数的实际分解》相关。 它使您能够测试公共RSA密钥是否存在所述的漏洞。 2017年11月4日更新 ：支持Python 2.7、3.4+。 2017年10月30日更新 ：攻击的论文已上线，ACM版本。 2017年10月30日更新 ：离散对数检测器现已在Python中实现并作为默认检测方法。它检测分解算法所利用的素数中的结构。 目前该工具支持以下密钥格式： X509证书，DER编码，每文件一个，.der，.crt X509证书，PEM编码，每文件多个，.pem...

secret_handshake

Secret Handshake - Un canal C2 de malware que utiliza certificados x509 sobre mTLS Motivación En primer lugar, ¿por qué liberaría esto como código abierto? MITRE ATT&CK solo habla de certificados robados o autofirmados, y los NDR por lo que sé prestan muy poca atención al contenido de los...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, skaffold, opentofu, metacontroller, rancher-fleet, tailscale, kubernetes-dashboard-metrics-scraper, nri-kubernetes, kubernetes-event-exporter, kafka-proxy, falcosidekick, cluster-api-aws-controller, nri-prometheus, k8sgpt, gke-gcloud-auth-plugin,...

CVE-2026-58101

A flaw was found in Crypt::OpenSSL::X509, a Perl module for handling X.509 certificates. A remote attacker could exploit this vulnerability by presenting a malformed X.509 certificate. This could lead to a Denial of Service DoS by causing the Perl process to crash due to a NULL pointer dereferenc...

MiracleLinux 8 : libreswan-4.12-2.el8_10.6 (AXSA:2026-1390:01)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1390:01 advisory. librenswan: IKEv1 Denial of Service via RSA-SHA1 PKCS1 Version 1.5 Encrypted authentication payload CVE-2026-50721 librenswan: IKEv2 Denial of Servi...

libreswan security update

An update is available for libreswan. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...

AlmaLinux 10 : libreswan (ALSA-2026:46398)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:46398 advisory. librenswan: IKEv1 Denial of Service via RSA-SHA1 PKCS1 Version 1.5 Encrypted authentication payload CVE-2026-50721 librenswan: IKEv2 Denial of Service v...

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET runtime cryptography layer CryptoNativeGetX509NameInfo. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

JLSEC-2026-723 Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion

Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion. A heap buffer overflow occurs when converting an X.509 certificate internally due to incorrect size handling of the AuthorityKeyIdentifier extension...

JLSEC-2026-735 Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain...

Un-negotiated Raw Public Key RFC 7250 accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually negotiated for that peer...

The vulnerability of the X.509 Certificate Handler component of the cryptographic C++ Botan library allows a perpetrator to forge OCSP responses.

The vulnerability of the X.509 Certificate Handler component of the C++ Botan cryptographic library is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to forge OCSP responses remotely...

Not Failing Securely ('Failing Open')

Overview Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' in the TlsServerEndpoint process when a server presents an X.509 certificate using a modern signature algorithm lacking traditional naming structures. An attacker can bypass strict client-side...

RHEL 9 : opentelemetry-collector (RHSA-2026:34359)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:34359 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: github.com/prometheus/prometheus: Prometheus:...

RockyLinux 8 : container-tools:rhel8 (RLSA-2026:33722)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:33722 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial...

UBUNTU-CVE-2026-55960

Un-negotiated Raw Public Key RFC 7250 accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually negotiated for that peer...

CVE-2026-6731 X.509 name constraint bypass via Subject CN treated as a DNS name

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted...

CVE-2026-6731

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted...