Skip to content

[automatic] Publish and update 3 advisories for wolfSSL_jll and libssh_jll #250

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jlsec-bot wants to merge 1 commit into
base: main
Choose a base branch
from
+69 −3
Open

[automatic] Publish and update 3 advisories for wolfSSL_jll and libssh_jll #250

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions advisories/published/2025/JLSEC-0000-mnu1vm18a-1ff5kia.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
```toml
schema_version = "1.7.4"
id = "JLSEC-0000-mnu1vm18a-1ff5kia"
modified = 2025-12-06T03:26:10.618Z
upstream = ["CVE-2024-1544"]
references = ["https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.2-stable"]

[[affected]]
pkg = "wolfSSL_jll"
ranges = ["< 5.7.2+0"]

[[jlsec_sources]]
id = "CVE-2024-1544"
imported = 2025-12-06T03:26:10.600Z
modified = 2025-12-06T01:03:02.317Z
published = 2024-08-27T19:15:16.547Z
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-1544"
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2024-1544"
[[jlsec_sources]]
id = "EUVD-2024-17291"
imported = 2025-12-06T03:26:10.754Z
modified = 2024-08-27T19:14:35.000Z
published = 2024-08-27T18:44:52.000Z
url = "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2024-17291"
html_url = "https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-17291"
fields = ["affected"]
```

# Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a mod...

Generating the ECDSA nonce k samples a random number r and then
truncates this randomness with a modular reduction mod n where n is the
order of the elliptic curve. Meaning k = r mod n. The division used
during the reduction estimates a factor q_e by dividing the upper two
digits (a digit having e.g. a size of 8 byte) of r by the upper digit of
n and then decrements q_e in a loop until it has the correct size.
Observing the number of times q_e is decremented through a control-flow
revealing side-channel reveals a bias in the most significant bits of
k. Depending on the curve this is either a negligible bias or a
significant bias large enough to reconstruct k with lattice reduction
methods. For SECP160R1, e.g., we find a bias of 15 bits.

24 changes: 24 additions & 0 deletions advisories/published/2025/JLSEC-0000-mnu1vm1co-vdh463.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
```toml
schema_version = "1.7.4"
id = "JLSEC-0000-mnu1vm1co-vdh463"
modified = 2025-12-06T03:26:10.776Z
upstream = ["CVE-2024-5814"]
references = ["https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#add_later"]

[[affected]]
pkg = "wolfSSL_jll"
ranges = ["< 5.7.2+0"]

[[jlsec_sources]]
id = "CVE-2024-5814"
imported = 2025-12-06T03:26:10.776Z
modified = 2025-12-06T00:54:13.963Z
published = 2024-08-27T19:15:17.980Z
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-5814"
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2024-5814"
```

# A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite t...

A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping fully parsing the server hello. https://doi.org/10.46586/tches.v2024.i1.457-500

6 changes: 3 additions & 3 deletions advisories/published/2025/JLSEC-2025-96.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,16 @@ id = "JLSEC-2025-96"
modified = 2025-12-01T22:35:06.458Z
published = 2025-10-19T18:40:48.457Z
upstream = ["CVE-2025-5318"]
references = ["https://access.redhat.com/errata/RHSA-2025:18231", "https://access.redhat.com/errata/RHSA-2025:18275", "https://access.redhat.com/errata/RHSA-2025:18286", "https://access.redhat.com/errata/RHSA-2025:19012", "https://access.redhat.com/errata/RHSA-2025:19098", "https://access.redhat.com/errata/RHSA-2025:19101", "https://access.redhat.com/errata/RHSA-2025:19295", "https://access.redhat.com/errata/RHSA-2025:19300", "https://access.redhat.com/errata/RHSA-2025:19313", "https://access.redhat.com/errata/RHSA-2025:19400", "https://access.redhat.com/errata/RHSA-2025:19401", "https://access.redhat.com/errata/RHSA-2025:19470", "https://access.redhat.com/errata/RHSA-2025:19472", "https://access.redhat.com/errata/RHSA-2025:19807", "https://access.redhat.com/errata/RHSA-2025:19864", "https://access.redhat.com/errata/RHSA-2025:20943", "https://access.redhat.com/errata/RHSA-2025:21013", "https://access.redhat.com/errata/RHSA-2025:21329", "https://access.redhat.com/errata/RHSA-2025:21829", "https://access.redhat.com/security/cve/CVE-2025-5318", "https://bugzilla.redhat.com/show_bug.cgi?id=2369131", "https://www.libssh.org/security/advisories/CVE-2025-5318.txt"]
references = ["https://access.redhat.com/errata/RHSA-2025:18231", "https://access.redhat.com/errata/RHSA-2025:18275", "https://access.redhat.com/errata/RHSA-2025:18286", "https://access.redhat.com/errata/RHSA-2025:19012", "https://access.redhat.com/errata/RHSA-2025:19098", "https://access.redhat.com/errata/RHSA-2025:19101", "https://access.redhat.com/errata/RHSA-2025:19295", "https://access.redhat.com/errata/RHSA-2025:19300", "https://access.redhat.com/errata/RHSA-2025:19313", "https://access.redhat.com/errata/RHSA-2025:19400", "https://access.redhat.com/errata/RHSA-2025:19401", "https://access.redhat.com/errata/RHSA-2025:19470", "https://access.redhat.com/errata/RHSA-2025:19472", "https://access.redhat.com/errata/RHSA-2025:19807", "https://access.redhat.com/errata/RHSA-2025:19864", "https://access.redhat.com/errata/RHSA-2025:20943", "https://access.redhat.com/errata/RHSA-2025:21013", "https://access.redhat.com/errata/RHSA-2025:21329", "https://access.redhat.com/errata/RHSA-2025:21829", "https://access.redhat.com/errata/RHSA-2025:22275", "https://access.redhat.com/security/cve/CVE-2025-5318", "https://bugzilla.redhat.com/show_bug.cgi?id=2369131", "https://www.libssh.org/security/advisories/CVE-2025-5318.txt"]

[[affected]]
pkg = "libssh_jll"
ranges = ["< 0.11.3+0"]

[[jlsec_sources]]
id = "CVE-2025-5318"
imported = 2025-11-28T03:26:58.026Z
modified = 2025-11-27T18:15:46.597Z
imported = 2025-12-06T03:26:12.112Z
modified = 2025-12-05T19:15:48.600Z
published = 2025-06-24T14:15:30.523Z
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-5318"
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2025-5318"
Expand Down
Loading