CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-50761 – Mozilla: S/MIME signature accepted despite mismatching message date
https://notcve.org/view.php?id=CVE-2023-50761
The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despite a date or time mismatch. This could be used to give recipients the impression that a message was sent at a different date or time. This vulnerability affects Thunderbird < 115.6. La firma de un mensaje de correo electrónico S/MIME firmado digitalmente puede especificar opcionalmente la fecha y hora de creación de la firma. • https://bugzilla.mozilla.org/show_bug.cgi?id=1865647 https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html https://www.debian.org/security/2023/dsa-5582 https://www.mozilla.org/security/advisories/mfsa2023-55 https://access.redhat.com/security/cve/CVE-2023-50761 https://bugzilla.redhat.com/show_bug.cgi?id=2255378 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-50762 – Mozilla: Truncated signed text was shown with a valid OpenPGP signature
https://notcve.org/view.php?id=CVE-2023-50762
When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header section. A digitally signed text from a different context, such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects Thunderbird < 115.6. Al procesar un payload PGP/MIME que contiene texto firmado digitalmente, el primer párrafo del texto nunca se mostró al usuario. • https://bugzilla.mozilla.org/show_bug.cgi?id=1862625 https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html https://www.debian.org/security/2023/dsa-5582 https://www.mozilla.org/security/advisories/mfsa2023-55 https://access.redhat.com/security/cve/CVE-2023-50762 https://bugzilla.redhat.com/show_bug.cgi?id=2255379 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 12CVE-2023-51385 – openssh: potential command injection via shell metacharacters
https://notcve.org/view.php?id=CVE-2023-51385
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name. En ssh en OpenSSH anterior a 9.6, la inyección de comandos del sistema operativo puede ocurrir si un nombre de usuario o nombre de host tiene metacaracteres de shell, y un token de expansión hace referencia a este nombre en ciertas situaciones. Por ejemplo, un repositorio Git que no es de confianza puede tener un submódulo con metacaracteres de shell en un nombre de usuario o nombre de host. A flaw was found in OpenSSH. • https://github.com/WOOOOONG/CVE-2023-51385 https://github.com/MiningBot-eth/CVE-2023-51385-exploit https://github.com/julienbrs/exploit-CVE-2023-51385 https://github.com/julienbrs/malicious-exploit-CVE-2023-51385 https://github.com/Le1a/CVE-2023-51385 https://github.com/thinkliving2020/CVE-2023-51385- https://github.com/farliy-hacker/CVE-2023-51385 https://github.com/farliy-hacker/CVE-2023-51385-save https://github.com/2048JiaLi/CVE-2023-51385 https://github.com/Sonicrrrr/ • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-51384
https://notcve.org/view.php?id=CVE-2023-51384
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys. En ssh-agent en OpenSSH anterior a 9.6, ciertas restricciones de destino se pueden aplicar de forma incompleta. Cuando se especifican restricciones de destino durante la adición de claves privadas alojadas en PKCS#11, estas restricciones solo se aplican a la primera clave, incluso si un token PKCS#11 devuelve varias claves. • http://seclists.org/fulldisclosure/2024/Mar/21 https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b https://security.netapp.com/advisory/ntap-20240105-0005 https://support.apple.com/kb/HT214084 https://www.debian.org/security/2023/dsa-5586 https://www.openssh.com/txt/release-9.6 https://www.openwall.com/lists/oss-security/2023/12/18/2 •
CVSS: 5.9EPSS: 96%CPEs: 79EXPL: 1CVE-2023-48795 – ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
https://notcve.org/view.php?id=CVE-2023-48795
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. • http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html http://seclists.org/fulldisclosure/2024/Mar/21 http://www.openwall.com/lists/oss-security/2023/12/18/3 http://www.openwall.com/lists/oss-security/2023/12/19/5 http://www.openwall.com/lists/oss-security/2023/12/20/3 http://www.openwall.com/lists/oss-security/2024/03/06/3 http://www.openwall.com/lists/oss-security/2024/04/17/8 https://access.redhat.com/security/cve/cve-2023-48 • CWE-222: Truncation of Security-relevant Information CWE-354: Improper Validation of Integrity Check Value •