4 results · Feed
-
Medium 6.8
openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER…
-
Medium 6.8
openCryptoki has improper link resolution before file access (link following)
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by plan…
-
Medium 5.9
Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)
A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the correspon…
-
Unscored —
A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is cr…