Vulnerabilities

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g.

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name.

A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format.

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.

A vulnerability was found in JWCrypto.

A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11).

The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million…