Sze Yiu Chau

**Nome do software vulnerável e versões afetadas** Google Chrome no ChromeOS, versões anteriores à 94.0.4606.54 **Descrição** O problema está relacionado a uma implementação inadequada no sistema de rede do ChromeOS, permitindo que um invasor remoto com um ponto de acesso sem fio malicioso possa potencialmente realizar um ataque de falsificação de identidade Wi-Fi por meio de um arquivo ONC manipulado. Isso poderia permitir que o invasor obtivesse acesso privilegiado à infraestrutura. **Recomendações** Para o Google Chrome no ChromeOS em versões anteriores à 94.0.4606.54, atualize para a versão 94.0.4606.54 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso a redes sem fio até que a atualização seja aplicada. Evite usar arquivos ONC criados de forma maliciosa no endpoint da API afetado até que o problema seja resolvido.

**Name of the Vulnerable Software and Affected Versions** Openswan versions prior to 2.6.50.1 **Description** The issue concerns the RSA implementation in the verify signed hash() function, which fails to verify the padding string value during PKCS#1 v1.5 signature verification. This allows a remote attacker to forge signatures, particularly when small public exponents are used. The IKEv2 signature verification is affected when RAW RSA keys are used. **Recommendations** For versions prior to 2.6.50.1, update to version 2.6.50.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** No information is available about the vulnerable software and its affected versions. **Description** The issue is related to a security problem, but specific details are not provided. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: strongSwan versions 4.x through 5.x before 5.7.0 Description: The issue is related to the verify emsa pkcs1 signature() function in the gmp plugin, which does not correctly verify cryptographic signatures. This can allow a remote attacker to forge signatures when small public exponents are used, potentially leading to impersonation when only an RSA signature is used for IKEv2 authentication. Recommendations: For strongSwan versions 4.x through 5.x before 5.7.0, update to version 5.7.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of small public exponents in RSA signatures until a patch is available.