Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SOS GmbH JobScheduler ausnutzen, um Daten zu verändern, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.
Product
Der JobScheduler ist eine Open-Source-Lösung für die Prozessautomatisierung auf Unternehmensebene.
Vulnerabilities 6
-
High 7.5
Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CP…
-
High 7.5
Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
-
Medium 5.9
Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.
-
Medium 5.3
Elliptic's EDDSA missing signature length check
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.
-
Medium 5.3
Elliptic's ECDSA missing check for whether leading bit of r and s is zero
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.
-
Medium 5.3CVE-2024-42461 Public exploit
Elliptic allows BER-encoded signatures
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
Revision history
-
#1
Initiale Fassung
References
-
JobScheduler Vulnerability Remediation Release 2.7.2 vom 2024-08-22
https://kb.sos-berlin.com/display/PKB/Vulnerability+Remediation+Release+2.7.2
-
JobScheduler Vulnerability Remediation Release 2.6.7 vom 2024-08-22
https://kb.sos-berlin.com/display/PKB/Vulnerability+Remediation+Release+2.6.7
-
JobScheduler Vulnerability Remediation Release 2.5.10 vom 2024-08-22
https://kb.sos-berlin.com/display/PKB/Vulnerability+Remediation+Release+2.5.10
-
JobScheduler Issue JS-2130 vom 2024-08-22
https://change.sos-berlin.com/browse/JS-2130
-
JobScheduler Issue JOC-1889 vom 2024-08-22
https://change.sos-berlin.com/browse/JOC-1889