GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-347

Allowed

Improper Verification of Cryptographic Signature

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

1336 vulnerabilities reference this CWE, most recent first.

GHSA-F4G9-H89H-JGV9

Vulnerability from github – Published: 2021-01-21 14:12 – Updated: 2024-10-14 15:50
VLAI
Summary
SAML XML Signature wrapping in PySAML2
Details

Impact

All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. pysaml2 <= 6.4.1 does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elements with a valid signature inside elements whose content has been malformed. The verification is offloaded to xmlsec1 and xmlsec1 will not validate every signature in the given document, but only the first it finds in the given scope.

Patches

Users should upgrade to pysaml2 v6.5.0.

Workarounds

No workaround provided at this point.

References

No references provided at this point.

Credits

  • Victor Schönfelder Garcia (isits AG International School of IT Security)
  • Juraj Somorovsky (Paderborn University)
  • Vladislav Mladenov (Ruhr University Bochum)

For more information

If you have any questions or comments about this advisory: * Open an issue in pysaml2 * Email us at the incident-response address

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pysaml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21238"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-01-21T14:11:38Z",
    "nvd_published_at": "2021-01-21T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nAll users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 \u003c= 6.4.1` does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elements with a valid signature inside elements whose content has been malformed. The verification is offloaded to `xmlsec1` and `xmlsec1` will not validate every signature in the given document, but only the first it finds in the given scope.\n\n### Patches\n\nUsers should upgrade to pysaml2 `v6.5.0`.\n\n### Workarounds\n\nNo workaround provided at this point.\n\n### References\n\nNo references provided at this point.\n\n### Credits\n\n- Victor Scho\u0308nfelder Garcia (isits AG International School of IT Security)\n- Juraj Somorovsky (Paderborn University)\n- Vladislav Mladenov (Ruhr University Bochum)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [pysaml2](https://github.com/IdentityPython/pysaml2)\n* Email us at [the incident-response address](mailto:incident-response@idpy.org)",
  "id": "GHSA-f4g9-h89h-jgv9",
  "modified": "2024-10-14T15:50:30Z",
  "published": "2021-01-21T14:12:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-f4g9-h89h-jgv9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21238"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IdentityPython/pysaml2/commit/1d8fd268f5bf887480a403a7a5ef8f048157cc14"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/IdentityPython/pysaml2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IdentityPython/pysaml2/releases/tag/v6.5.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pysaml2/PYSEC-2021-48.yaml"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/pysaml2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SAML XML Signature wrapping in PySAML2"
}

GHSA-F4X5-257X-2739

Vulnerability from github – Published: 2023-10-19 12:30 – Updated: 2024-04-04 08:47
VLAI
Details

The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.

Severity
8.2 (High)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-25333"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-19T10:15:09Z",
    "severity": "HIGH"
  },
  "details": "The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.",
  "id": "GHSA-f4x5-257x-2739",
  "modified": "2024-04-04T08:47:24Z",
  "published": "2023-10-19T12:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25333"
    },
    {
      "type": "WEB",
      "url": "https://tetraburst.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F5P4-P5Q5-JV3H

Vulnerability from github – Published: 2025-10-28 17:49 – Updated: 2025-11-05 22:11
VLAI
Summary
Contrast has insecure LUKS2 persistent storage partitions may be opened and used
Details

Summary

A malicious host may provide a crafted LUKS2 volume to a Contrast pod VM that uses the secure persistent volume feature. The guest will open the volume and write secret data using a volume key known to the attacker.

LUKS2 volume metadata is (a) not authenticated and (b) supports null key-encryption algorithms, allowing an attacker to create a volume such that the volume:

  • Opens (cryptsetup open) without error using any passphrase or token
  • Records all writes in plaintext (or ciphertext with an attacker-known key)

Details

Contrast uses cryptsetup to setup secure persistent volumes, using the secret seed as key for the cryptsetup encryption. To do so the Contrast Initializer will invoke the cryptsetup CLI. If the device provided by Kubernetes is a identified as cryptsetup device, the Initializer assumes a pod restart happened and the device was previously encrypted with the secret seed. The Initializer will try to open the device, and assume it is protected if the operation succeeds. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all.

Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field.

Impact

Using a maliciously crafted cryptsetup device, an attacker can read confidential data that was written to the persistent volume that should have been protected by encryption.

Notice that Contrast's persistent volumes weren't integrity protected, so the integrity impact of this attack isn't considered.

Patches

A partial fix landed in cryptsetup version 2.8.1, disabling null ciphers in keyslots when the user passphrase is nonempty. Contrast shipped this cryptsetup version shortly after it has been released upstream, in Contrast version v1.12.1.

However, LUKS header parsing and interpretation remains a large attack surface. Attackers may still be able to modify LUKS headers in other ways, such as triggering automatic reencryption or downgrading to weak ciphers. As a long term hardening solution, LUKS disks is encrypted in detached header mode. The detached header resides in a tmpfs file inside guest RAM, and is checked before it is used to open the device. This has been implemented in #1731 and released as part of Contrast v1.13.0.

In addition, we added integrity protection for secure persistent storage as a new feature in #1734, which was also shipped as part of v1.13.0.

Severity
5.7 (Medium)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.12.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/edgelesssys/contrast"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-347",
      "CWE-552"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-28T17:49:59Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA malicious host may provide a crafted LUKS2 volume to a Contrast pod VM that uses the [secure persistent volume](https://docs.edgeless.systems/contrast/howto/encrypted-storage) feature. The guest will open the volume and write secret data using a volume key known to the attacker. \n\nLUKS2 volume metadata is (a) not authenticated and (b) supports null key-encryption algorithms, allowing an attacker to create a volume such that the volume:\n\n- Opens (cryptsetup open) without error using any passphrase or token\n- Records all writes in plaintext (or ciphertext with an attacker-known key)\n\n### Details\n\nContrast uses cryptsetup to setup secure persistent volumes, using the secret seed as key for the cryptsetup encryption. To do so the Contrast Initializer will invoke the `cryptsetup` CLI. If the device provided by Kubernetes is a identified as cryptsetup device, the Initializer assumes a pod restart happened and the device was previously encrypted with the secret seed. The Initializer will try to open the device, and assume it is protected if the operation succeeds. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all.\n\nCryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the `cipher_null-ecb` algorithm in the keyslot `encryption` field.\n\n### Impact\n\nUsing a maliciously crafted cryptsetup device, an attacker can read confidential data that was written to the persistent volume that should have been protected by encryption.\n\nNotice that Contrast\u0027s persistent volumes weren\u0027t integrity protected, so the integrity impact of this attack isn\u0027t considered.\n\n### Patches\n\nA partial fix landed in [cryptsetup version 2.8.1](https://gitlab.com/cryptsetup/cryptsetup/-/blob/main/docs/v2.8.1-ReleaseNotes#L14), disabling null ciphers in keyslots when the user passphrase is nonempty. Contrast shipped this cryptsetup version shortly after it has been released upstream, in [Contrast version v1.12.1](https://github.com/edgelesssys/contrast/releases/tag/v1.12.1).\n\nHowever, LUKS header parsing and interpretation remains a large attack surface. Attackers may still be able to modify LUKS headers in other ways, such as triggering automatic reencryption or downgrading to weak ciphers. As a long term hardening solution, LUKS disks is encrypted in detached header mode. The detached header resides in a tmpfs file inside guest RAM, and is checked before it is used to open the device. This has been implemented in [#1731](https://github.com/edgelesssys/contrast/pull/1731) and released as part of [Contrast v1.13.0](https://github.com/edgelesssys/contrast/releases/tag/v1.13.0).\n\nIn addition, we added integrity protection for secure persistent storage as a new feature in [#1734](https://github.com/edgelesssys/contrast/pull/1734), which was also shipped as part of [v1.13.0](https://github.com/edgelesssys/contrast/releases/tag/v1.13.0).",
  "id": "GHSA-f5p4-p5q5-jv3h",
  "modified": "2025-11-05T22:11:22Z",
  "published": "2025-10-28T17:49:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/edgelesssys/contrast/security/advisories/GHSA-f5p4-p5q5-jv3h"
    },
    {
      "type": "WEB",
      "url": "https://github.com/edgelesssys/contrast/pull/1731"
    },
    {
      "type": "WEB",
      "url": "https://github.com/edgelesssys/contrast/commit/2252a231d570c2dce10a33660452b0bfc3c43958"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/edgelesssys/contrast"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-4078"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Contrast has insecure LUKS2 persistent storage partitions may be opened and used"
}

GHSA-F67F-6CW9-8MQ4

Vulnerability from github – Published: 2026-01-13 21:51 – Updated: 2026-01-13 21:51
VLAI
Summary
Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass
Details

Summary

A flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted.

Details

When verifying JWTs using JWKs or a JWKS endpoint, the middleware selected the verification algorithm based on the JWK’s alg field if present, but otherwise fell back to the alg value provided in the unverified JWT header.

Because the alg field in a JWK is optional and often omitted in real-world JWKS configurations, this behavior could allow an attacker to control the algorithm used for verification. In some environments, this may lead to authentication or authorization bypass through crafted tokens.

The practical impact depends on application configuration, including which algorithms are accepted and how JWTs are used for authorization decisions.

Impact

In affected configurations, an attacker may be able to forge JWTs with attacker-controlled claims, potentially resulting in authentication or authorization bypass.

Applications that do not use the JWK/JWKS middleware, do not rely on JWT-based authentication, or explicitly restrict allowed algorithms are not affected.

Resolution

Update to the latest patched release.

Breaking change:

As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values.

Applications upgrading must update their configuration accordingly.

Before (vulnerable configuration)

import { jwt } from 'hono/jwt'

app.use(
  '/auth/*',
  jwt({
    secret: 'it-is-very-secret',
    // alg was optional
  })
)

After (patched configuration)

import { jwt } from 'hono/jwt'

app.use(
  '/auth/*',
  jwt({
    secret: 'it-is-very-secret',
    alg: 'HS256', // required
  })
)
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "hono"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22817"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-13T21:51:44Z",
    "nvd_published_at": "2026-01-13T20:16:11Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the JWT header\u2019s `alg` value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable **JWT algorithm confusion** and, in certain configurations, allow forged tokens to be accepted.\n\n## Details\n\nWhen verifying JWTs using JWKs or a JWKS endpoint, the middleware selected the verification algorithm based on the JWK\u2019s `alg` field if present, but otherwise fell back to the `alg` value provided in the unverified JWT header.\n\nBecause the `alg` field in a JWK is optional and often omitted in real-world JWKS configurations, this behavior could allow an attacker to control the algorithm used for verification. In some environments, this may lead to authentication or authorization\nbypass through crafted tokens.\n\nThe practical impact depends on application configuration, including which algorithms are accepted and how JWTs are used for authorization decisions.\n\n## Impact\n\nIn affected configurations, an attacker may be able to forge JWTs with attacker-controlled claims, potentially resulting in authentication or authorization bypass.\n\nApplications that do not use the JWK/JWKS middleware, do not rely on JWT-based authentication, or explicitly restrict allowed algorithms are not affected.\n\n## Resolution\n\nUpdate to the latest patched release.\n\n**Breaking change:**\n\nAs part of this fix, the JWT middleware now requires the `alg` option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values.\n\nApplications upgrading must update their configuration accordingly.\n\n### Before (vulnerable configuration)\n\n```ts\nimport { jwt } from \u0027hono/jwt\u0027\n\napp.use(\n  \u0027/auth/*\u0027,\n  jwt({\n    secret: \u0027it-is-very-secret\u0027,\n    // alg was optional\n  })\n)\n```\n\n### After (patched configuration)\n\n```ts\nimport { jwt } from \u0027hono/jwt\u0027\n\napp.use(\n  \u0027/auth/*\u0027,\n  jwt({\n    secret: \u0027it-is-very-secret\u0027,\n    alg: \u0027HS256\u0027, // required\n  })\n)\n```",
  "id": "GHSA-f67f-6cw9-8mq4",
  "modified": "2026-01-13T21:51:45Z",
  "published": "2026-01-13T21:51:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22817"
    },
    {
      "type": "WEB",
      "url": "https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/honojs/hono"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Hono JWT Middleware\u0027s JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass"
}

GHSA-F6RC-73VX-29H5

Vulnerability from github – Published: 2024-07-31 21:32 – Updated: 2024-08-15 15:30
VLAI
Details

An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-41258"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-31T21:15:18Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.",
  "id": "GHSA-f6rc-73vx-29h5",
  "modified": "2024-08-15T15:30:53Z",
  "published": "2024-07-31T21:32:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41258"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/nyxfqq/ed8c2ba3398c9e28cd8dbf0902bd8edf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F7Q4-PWC6-W24P

Vulnerability from github – Published: 2024-08-02 09:31 – Updated: 2025-11-04 16:51
VLAI
Summary
Elliptic's EDDSA missing signature length check
Details

In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2.7 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.5.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "elliptic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "6.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-42459"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-05T13:21:11Z",
    "nvd_published_at": "2024-08-02T07:16:10Z",
    "severity": "LOW"
  },
  "details": "In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.",
  "id": "GHSA-f7q4-pwc6-w24p",
  "modified": "2025-11-04T16:51:32Z",
  "published": "2024-08-02T09:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42459"
    },
    {
      "type": "WEB",
      "url": "https://github.com/indutny/elliptic/pull/317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b33893100bb42d11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/indutny/elliptic/commit/c0690b36be043ee73c1780ae4b7df48632b11cf9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/indutny/elliptic"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20241004-0005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Elliptic\u0027s EDDSA missing signature length check"
}

GHSA-F7WW-C7V4-G682

Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-06-04 00:00
VLAI
Details

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-3421"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-19T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.",
  "id": "GHSA-f7ww-c7v4-g682",
  "modified": "2022-06-04T00:00:32Z",
  "published": "2022-05-24T19:02:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3421"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927747"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMGXO3W6DHPO62GJ4VVF5DEUX5DRUR5K"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHRPNBCRPDJHHQE3MBPSZK4H7X2IM7AC"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILPBTPSBRYL4POBI3F4YUSVPSOQNJBY"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202107-43"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F9VH-CWPR-5M8F

Vulnerability from github – Published: 2025-07-28 18:31 – Updated: 2026-01-16 15:31
VLAI
Details

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
5.9 (Medium)
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-43023"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-28T18:15:25Z",
    "severity": "MODERATE"
  },
  "details": "A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).",
  "id": "GHSA-f9vh-cwpr-5m8f",
  "modified": "2026-01-16T15:31:22Z",
  "published": "2025-07-28T18:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43023"
    },
    {
      "type": "WEB",
      "url": "https://support.hp.com/us-en/document/ish_12804224-12804228-16/hpsbpi04033"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/08/22/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FC26-M9PF-V56Q

Vulnerability from github – Published: 2026-06-18 13:52 – Updated: 2026-07-20 21:23
VLAI
Summary
PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
Details

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

Summary

PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely.

An unauthenticated network caller who can reach the webhook endpoint can submit a forged Linear-Event: AgentSession request. The forged request is parsed, scheduled for background processing, dispatched to _handle_agent_session(), and passed into BotSessionManager.chat(). The bot then attempts to post the agent response back to Linear under the configured bot token.

The local PoV is offline and deterministic. It does not contact Linear. It calls the webhook handler directly, monkey-patches the outbound Linear comment path, and proves both sides of the boundary:

  • no secret configured: unsigned forged webhook returns 200, invokes the agent session path once, and attempts one Linear comment;
  • secret configured: missing and bad signatures both return 401 and do not invoke the agent;
  • secret configured with valid HMAC: request returns 200 and invokes the agent, proving the control path still works.

Affected Product

  • Repository: MervinPraison/PraisonAI
  • Package: praisonai
  • Components:
  • src/praisonai/praisonai/bots/linear.py
  • src/praisonai/praisonai/cli/features/bots_cli.py

Validated affected:

  • live main / latest observed release v4.6.58: 1ad58ca02975ff1398efeda694ea2ab78f20cf3e
  • previous local current checkout: 2f9677abb2ea68eab864ee8b6a828fd0141612e1
  • v4.6.57
  • v4.6.56
  • v4.5.50

Sampled tags where the LinearBot component was not present:

  • v4.5.49
  • v4.5.51
  • v4.6.9
  • v4.6.10

Suggested affected range: LinearBot-bearing releases with the fail-open signature behavior, at least 4.5.50 and >= 4.6.56, <= 4.6.58. The component appears non-contiguously in sampled tags, so maintainers should confirm the exact packaged version history before publishing a final range.

Root Cause

LinearBot.__init__() accepts an empty signing secret and falls back to an empty environment value:

self._signing_secret = signing_secret or os.environ.get("LINEAR_WEBHOOK_SECRET", "")

start() treats the missing secret as a warning instead of refusing to expose the webhook listener:

if not self._signing_secret:
    logger.warning("LINEAR_WEBHOOK_SECRET not set - webhook signatures will not be verified")

self._site = web.TCPSite(self._runner, "0.0.0.0", self._webhook_port)

_handle_webhook() only verifies the request if the secret is truthy:

if self._signing_secret:
    signature = request.headers.get("Linear-Signature", "")
    if not self._verify_signature(raw_body, signature):
        return web.Response(status=401, text="Invalid signature")

With no secret configured, the code continues to JSON parsing, accepts a caller supplied webhookTimestamp, reads the caller supplied Linear-Event header, and schedules processing:

event_type = request.headers.get("Linear-Event", "")
task = asyncio.create_task(self._process_webhook(event_type, body))
return web.Response(status=200, text="OK")

For AgentSession, the forged body is routed to the agent:

if event_type == "AgentSession":
    await self._handle_agent_session(body)
...
response = await self._session_mgr.chat(self._agent, user_id, message.content)
await self._send_comment(...)

The CLI has the same fail-open posture: start_linear() loads LINEAR_WEBHOOK_SECRET, prints a warning when it is missing, then reports a public http://0.0.0.0:<port>/webhook endpoint with verification disabled.

Why This Is Not Intended Behavior

PraisonAI's Linear Bot documentation tells operators to set LINEAR_WEBHOOK_SECRET, pass it to praisonai bot linear, copy the Linear webhook signing secret, and use it for HMAC-SHA256 verification. The same page says missing secrets disable signature verification, while its best-practices section says webhook secrets ensure authenticity.

Linear's webhook documentation says receivers should ensure requests were sent by Linear by verifying the Linear-Signature HMAC over the raw body, then checking that webhookTimestamp is recent. The timestamp check alone is not an authentication boundary because an attacker can supply a current timestamp in a forged body.

The implementation itself also confirms the intended boundary: when a secret is configured, missing and bad signatures are rejected before agent dispatch. The bug is the missing-secret fail-open mode on a public webhook server, not the signature algorithm.

Local PoV

Run against the latest observed release checkout:

python3 submission-bundle/praisonai-prai-cand-013-linear-webhook-signature-fail-open/poc/pov_prai_cand_013_linear_webhook_signature_fail_open.py --repo artifacts/repos/praisonai-v4.6.58

Expected output includes:

{
  "candidate": "PRAI-CAND-013",
  "ok": true,
  "cases": {
    "no_secret_unsigned_forged_webhook": {
      "http_status": 200,
      "signing_secret_configured": false,
      "session_calls": [
        {
          "user_id": "linear-system",
          "content": "Issue: Forged Linear AgentSession event\n\nPRAI-CAND-013 local forged webhook payload"
        }
      ],
      "sent_comments": [
        {
          "issue_id": "issue-prai-cand-013",
          "comment": "agent response",
          "session_id": "prai-cand-013-session"
        }
      ]
    },
    "secret_missing_signature_control": {
      "http_status": 401,
      "session_calls": []
    },
    "secret_bad_signature_control": {
      "http_status": 401,
      "session_calls": []
    },
    "secret_valid_signature_control": {
      "http_status": 200,
      "session_calls": [
        {
          "user_id": "linear-system"
        }
      ]
    }
  }
}

Stored evidence:

  • evidence/pov-v4.6.58.json
  • evidence/pov-live-main-v4.6.58.json
  • evidence/pov-current-head.json
  • evidence/version-sweep.tsv

Impact

If a PraisonAI operator starts LinearBot with a Linear token but omits LINEAR_WEBHOOK_SECRET, any network caller that can reach the webhook endpoint can spoof Linear webhook events and invoke the configured agent through the Linear integration.

For the AgentSession event path, this lets the attacker supply issue title and description content that becomes the agent input. Depending on the configured agent and tools, this can cause unauthorized LLM/tool execution, consume paid model quota, create or update Linear comments under the bot identity, and drive the bot into workflows intended only for authenticated Linear events.

This report does not claim arbitrary code execution by default. The concrete boundary crossed is unauthenticated remote agent invocation through a forged Linear webhook.

Suggested Fix

Fail closed for public webhook listeners:

  1. Refuse to start LinearBot when LINEAR_WEBHOOK_SECRET is missing, unless an explicit development-only option such as --insecure-skip-webhook-signature-verification is provided.
  2. In _handle_webhook(), reject requests when no signing secret is configured instead of silently skipping verification.
  3. Preserve raw-body HMAC verification and constant-time comparison for the configured-secret path.
  4. Treat timestamp freshness as replay protection after signature validation, not as a replacement for authentication.
  5. Prefer loopback binding by default, or require an explicit host flag for public binding.
  6. Add regression tests:
  7. no signing secret rejects startup or rejects webhook requests;
  8. missing signature with a configured secret returns 401;
  9. invalid signature with a configured secret returns 401;
  10. valid HMAC with a configured secret returns success;
  11. stale timestamp after valid HMAC returns 401;
  12. the CLI does not advertise a public unauthenticated webhook by default.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.58"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.6.56"
            },
            {
              "fixed": "4.6.59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56837"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-306",
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T13:52:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# PraisonAI LinearBot processes unsigned webhooks when `LINEAR_WEBHOOK_SECRET` is missing\n\n## Summary\n\nPraisonAI\u0027s LinearBot starts a public webhook listener on `0.0.0.0` and treats\n`LINEAR_WEBHOOK_SECRET` as optional. When the secret is absent, startup only logs\na warning and `_handle_webhook()` skips `Linear-Signature` verification entirely.\n\nAn unauthenticated network caller who can reach the webhook endpoint can submit\na forged `Linear-Event: AgentSession` request. The forged request is parsed,\nscheduled for background processing, dispatched to `_handle_agent_session()`,\nand passed into `BotSessionManager.chat()`. The bot then attempts to post the\nagent response back to Linear under the configured bot token.\n\nThe local PoV is offline and deterministic. It does not contact Linear. It calls\nthe webhook handler directly, monkey-patches the outbound Linear comment path,\nand proves both sides of the boundary:\n\n- no secret configured: unsigned forged webhook returns `200`, invokes the\n  agent session path once, and attempts one Linear comment;\n- secret configured: missing and bad signatures both return `401` and do not\n  invoke the agent;\n- secret configured with valid HMAC: request returns `200` and invokes the\n  agent, proving the control path still works.\n\n## Affected Product\n\n- Repository: `MervinPraison/PraisonAI`\n- Package: `praisonai`\n- Components:\n  - `src/praisonai/praisonai/bots/linear.py`\n  - `src/praisonai/praisonai/cli/features/bots_cli.py`\n\nValidated affected:\n\n- live `main` / latest observed release `v4.6.58`:\n  `1ad58ca02975ff1398efeda694ea2ab78f20cf3e`\n- previous local current checkout:\n  `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n- `v4.6.57`\n- `v4.6.56`\n- `v4.5.50`\n\nSampled tags where the LinearBot component was not present:\n\n- `v4.5.49`\n- `v4.5.51`\n- `v4.6.9`\n- `v4.6.10`\n\nSuggested affected range: LinearBot-bearing releases with the fail-open\nsignature behavior, at least `4.5.50` and `\u003e= 4.6.56, \u003c= 4.6.58`. The\ncomponent appears non-contiguously in sampled tags, so maintainers should\nconfirm the exact packaged version history before publishing a final range.\n\n## Root Cause\n\n`LinearBot.__init__()` accepts an empty signing secret and falls back to an\nempty environment value:\n\n```python\nself._signing_secret = signing_secret or os.environ.get(\"LINEAR_WEBHOOK_SECRET\", \"\")\n```\n\n`start()` treats the missing secret as a warning instead of refusing to expose\nthe webhook listener:\n\n```python\nif not self._signing_secret:\n    logger.warning(\"LINEAR_WEBHOOK_SECRET not set - webhook signatures will not be verified\")\n\nself._site = web.TCPSite(self._runner, \"0.0.0.0\", self._webhook_port)\n```\n\n`_handle_webhook()` only verifies the request if the secret is truthy:\n\n```python\nif self._signing_secret:\n    signature = request.headers.get(\"Linear-Signature\", \"\")\n    if not self._verify_signature(raw_body, signature):\n        return web.Response(status=401, text=\"Invalid signature\")\n```\n\nWith no secret configured, the code continues to JSON parsing, accepts a caller\nsupplied `webhookTimestamp`, reads the caller supplied `Linear-Event` header,\nand schedules processing:\n\n```python\nevent_type = request.headers.get(\"Linear-Event\", \"\")\ntask = asyncio.create_task(self._process_webhook(event_type, body))\nreturn web.Response(status=200, text=\"OK\")\n```\n\nFor `AgentSession`, the forged body is routed to the agent:\n\n```python\nif event_type == \"AgentSession\":\n    await self._handle_agent_session(body)\n...\nresponse = await self._session_mgr.chat(self._agent, user_id, message.content)\nawait self._send_comment(...)\n```\n\nThe CLI has the same fail-open posture: `start_linear()` loads\n`LINEAR_WEBHOOK_SECRET`, prints a warning when it is missing, then reports a\npublic `http://0.0.0.0:\u003cport\u003e/webhook` endpoint with verification disabled.\n\n## Why This Is Not Intended Behavior\n\nPraisonAI\u0027s Linear Bot documentation tells operators to set\n`LINEAR_WEBHOOK_SECRET`, pass it to `praisonai bot linear`, copy the Linear\nwebhook signing secret, and use it for HMAC-SHA256 verification. The same page\nsays missing secrets disable signature verification, while its best-practices\nsection says webhook secrets ensure authenticity.\n\nLinear\u0027s webhook documentation says receivers should ensure requests were sent\nby Linear by verifying the `Linear-Signature` HMAC over the raw body, then\nchecking that `webhookTimestamp` is recent. The timestamp check alone is not an\nauthentication boundary because an attacker can supply a current timestamp in a\nforged body.\n\nThe implementation itself also confirms the intended boundary: when a secret is\nconfigured, missing and bad signatures are rejected before agent dispatch. The\nbug is the missing-secret fail-open mode on a public webhook server, not the\nsignature algorithm.\n\n## Local PoV\n\nRun against the latest observed release checkout:\n\n```bash\npython3 submission-bundle/praisonai-prai-cand-013-linear-webhook-signature-fail-open/poc/pov_prai_cand_013_linear_webhook_signature_fail_open.py --repo artifacts/repos/praisonai-v4.6.58\n```\n\nExpected output includes:\n\n```json\n{\n  \"candidate\": \"PRAI-CAND-013\",\n  \"ok\": true,\n  \"cases\": {\n    \"no_secret_unsigned_forged_webhook\": {\n      \"http_status\": 200,\n      \"signing_secret_configured\": false,\n      \"session_calls\": [\n        {\n          \"user_id\": \"linear-system\",\n          \"content\": \"Issue: Forged Linear AgentSession event\\n\\nPRAI-CAND-013 local forged webhook payload\"\n        }\n      ],\n      \"sent_comments\": [\n        {\n          \"issue_id\": \"issue-prai-cand-013\",\n          \"comment\": \"agent response\",\n          \"session_id\": \"prai-cand-013-session\"\n        }\n      ]\n    },\n    \"secret_missing_signature_control\": {\n      \"http_status\": 401,\n      \"session_calls\": []\n    },\n    \"secret_bad_signature_control\": {\n      \"http_status\": 401,\n      \"session_calls\": []\n    },\n    \"secret_valid_signature_control\": {\n      \"http_status\": 200,\n      \"session_calls\": [\n        {\n          \"user_id\": \"linear-system\"\n        }\n      ]\n    }\n  }\n}\n```\n\nStored evidence:\n\n- `evidence/pov-v4.6.58.json`\n- `evidence/pov-live-main-v4.6.58.json`\n- `evidence/pov-current-head.json`\n- `evidence/version-sweep.tsv`\n\n## Impact\n\nIf a PraisonAI operator starts LinearBot with a Linear token but omits\n`LINEAR_WEBHOOK_SECRET`, any network caller that can reach the webhook endpoint\ncan spoof Linear webhook events and invoke the configured agent through the\nLinear integration.\n\nFor the `AgentSession` event path, this lets the attacker supply issue title and\ndescription content that becomes the agent input. Depending on the configured\nagent and tools, this can cause unauthorized LLM/tool execution, consume paid\nmodel quota, create or update Linear comments under the bot identity, and drive\nthe bot into workflows intended only for authenticated Linear events.\n\nThis report does not claim arbitrary code execution by default. The concrete\nboundary crossed is unauthenticated remote agent invocation through a forged\nLinear webhook.\n\n## Suggested Fix\n\nFail closed for public webhook listeners:\n\n1. Refuse to start LinearBot when `LINEAR_WEBHOOK_SECRET` is missing, unless an\n   explicit development-only option such as\n   `--insecure-skip-webhook-signature-verification` is provided.\n2. In `_handle_webhook()`, reject requests when no signing secret is configured\n   instead of silently skipping verification.\n3. Preserve raw-body HMAC verification and constant-time comparison for the\n   configured-secret path.\n4. Treat timestamp freshness as replay protection after signature validation,\n   not as a replacement for authentication.\n5. Prefer loopback binding by default, or require an explicit host flag for\n   public binding.\n6. Add regression tests:\n   - no signing secret rejects startup or rejects webhook requests;\n   - missing signature with a configured secret returns `401`;\n   - invalid signature with a configured secret returns `401`;\n   - valid HMAC with a configured secret returns success;\n   - stale timestamp after valid HMAC returns `401`;\n   - the CLI does not advertise a public unauthenticated webhook by default.",
  "id": "GHSA-fc26-m9pf-v56q",
  "modified": "2026-07-20T21:23:38Z",
  "published": "2026-06-18T13:52:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing"
}

GHSA-FC79-J7VW-6XJG

Vulnerability from github – Published: 2022-05-14 01:01 – Updated: 2022-05-14 01:01
VLAI
Details

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-12019"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-13T23:29:00Z",
    "severity": "HIGH"
  },
  "details": "The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.",
  "id": "GHSA-fc79-j7vw-6xjg",
  "modified": "2022-05-14T01:01:32Z",
  "published": "2022-05-14T01:01:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12019"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.enigmail.net/index.php/en/download/changelog"
    },
    {
      "type": "WEB",
      "url": "http://openwall.com/lists/oss-security/2018/06/13/10"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2019/Apr/38"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/04/30/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-463: Padding Oracle Crypto Attack

An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.

CAPEC-475: Signature Spoofing by Improper Validation

An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.

← Back to the CWE list