Bhargava Shastry

An issue exists in the AES-GCM-SIV implementation where a zero-length Additional Authenticated Data (AAD) update is treated as a reset of all previously supplied AAD instead of leaving it unchanged. This causes messages to be produced or verified with authentication tags that do not cover the AAD provided before the empty fragment, allowing an attacker to forge the AAD. Additionally, AAD was not reset during context re-initialisation, meaning AAD from previous context usage was incorrectly included in new messages.

The high-level OpenPGP certificate API fails to verify if a component key of an issuing certificate has the required authority to certify when processing third-party certifications or trust delegations. Specifically, the functions `getCertificationBy()` and `getDelegationBy()` in the `OpenPGPCertificate` class verify the signature and binding chain but do not check for the `CERTIFY OTHER` key flag as required by RFC 9580. This allows a restricted subkey, such as one bound only for `SIGN DATA` or encryption, to issue a valid User ID certification or a direct-key delegation of trust. Consequently, an application may incorrectly attribute an attacker's assertion to the offline primary key, bypassing the security containment intended by key-flag separation.

The streaming CMS AuthenticatedData parser fails to properly validate the consistency between the `digestAlgorithm` and `authAttrs` fields. According to RFC 5652, `authAttrs` must be present whenever `digestAlgorithm` is. The `CMSAuthenticatedDataParser` constructor relies solely on `digestAlgorithm` to determine if authenticated attributes are present. Consequently, if `digestAlgorithm` is absent but `authAttrs` is present, the parser verifies the content MAC but returns the attributes via `getAuthAttrs()` as if they were authenticated, even though the MAC did not cover them. This allows an attacker to modify a message in transit to insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, without possessing the key-encryption or content-MAC keys. Applications relying on these attributes for authorization, routing, or labeling decisions may then act on attacker-controlled values.

An issue exists in the `BLS12 381BasicScheme.keyValidate` function, affecting `BLSPublicKeyParameters` and the `verify` and `aggregateVerify` methods of `BasicScheme`, `MessageAugmentation`, and `ProofOfPossession`. The system accepts public keys built on a foreign `ECCurve` that shares the field characteristic of BLS12-381. Because the prime-order subgroup check relies on the point's own curve to define its cofactor, a point on a curve with a different equation and a forged cofactor of one can bypass `keyValidate` without being a valid G1 point. In the pairing implementation, such a point contributes the identity in the target group, allowing an aggregate signature to be accepted even if it lacks a signature for that specific key and message pair, effectively permitting a phantom signer. This is only reachable if an application constructs an `ECPoint` on an explicit, non-canonical curve and accepts it as an authority-bearing key.

The issue concerns a buffer over-read in the VRRP parser for VRRP version 3, which occurs in the `vrrp print()` function in `print-vrrp.c`. Additionally, there is a heap-based buffer over-read related to `aoe print` in `print-aoe.c` and `lookup emem` in `addrtoname.c`.

The issue is related to a buffer over-read in the `bgp capabilities print()` function in `print-bgp.c`, which can cause a denial of service. This can be exploited by a remote attacker. The `bgp capabilities print()` function is used for printing BGP capabilities. The vulnerability is also related to the `BGP CAPCODE RESTART` code. Additionally, there is a heap-based buffer over-read related to the `aoe print` function in `print-aoe.c` and the `lookup emem` function in `addrtoname.c`.

The issue is related to a buffer over-read in the LDP parser of the tcpdump utility, specifically in the `ldp tlv print()` function located in `print-ldp.c`. This can be exploited by a remote attacker to cause a denial of service or potentially gain unauthorized access to information, compromising its integrity and availability.

The issue is related to a buffer over-read in the VRRP parser, specifically in the `vrrp print()` function, which can be exploited by a remote attacker to gain unauthorized access to information, compromise its integrity and availability, or cause a denial of service. The vulnerability is associated with the VRRP version 2 parser in `print-vrrp.c`.

The issue is related to a buffer over-read in the FRF.16 parser, specifically in the `mfr print()` function within `print-fr.c`. This can allow a remote attacker to gain unauthorized access to information and impact its integrity and availability. Additionally, the vulnerability may cause a denial of service. The `aoe print` function in `print-aoe.c` and `lookup emem` in `addrtoname.c` are also related to a heap-based buffer over-read.

The issue is related to a buffer over-read in the IKEv1 parser, specifically in the `ikev1 n print()` function within `print-isakmp.c`. This can allow a remote attacker to gain unauthorized access to information and impact its integrity and availability. Additionally, it may cause a denial of service. The problem is also associated with a heap-based buffer over-read related to `aoe print` in `print-aoe.c` and `lookup emem` in `addrtoname.c`.

The issue is related to a buffer over-read in the Rx parser, specifically in the `rx cache find()` and `rx cache insert()` functions. This can allow a remote attacker to gain unauthorized access to information, compromise its integrity and availability, or cause a denial of service. The `aoe print` function in `print-aoe.c` and the `lookup emem` function in `addrtoname.c` are also affected by a heap-based buffer over-read.

The issue is related to a buffer over-read in the ICMP parser, specifically in the `icmp print()` function in `print-icmp.c`. This can be exploited by a remote attacker to cause a denial of service or potentially gain unauthorized access to information, compromising its integrity and availability.

The issue is related to a buffer over-read in the BGP parser of the tcpdump utility, specifically in the `bgp capabilities print()` function. This can be exploited by a remote attacker to cause a denial of service or potentially gain unauthorized access to information, affecting its integrity and availability.

The issue is related to a buffer over-read in the LMP parser of the tcpdump utility, specifically in the `lmp print data link subobjs()` function in `print-lmp.c`. This can allow a remote attacker to gain unauthorized access to information and impact its integrity and availability. Additionally, it may cause a denial of service. The `aoe print` function in `print-aoe.c` and the `lookup emem` function in `addrtoname.c` are also related to a heap-based buffer over-read.

The issue is related to memory leaks that occur while parsing malformed OpenFlow group mod messages. It is noted that the vendor disputes the relevance of this report, stating that it can only be triggered by an OpenFlow controller, which has more direct and powerful ways to force Open vSwitch to allocate memory.

The issue is related to a buffer over-read in the ISO IS-IS parser, specifically within the print-isoclns.c file, affecting several functions.

The issue is related to a buffer over-read in the IPv6 mobility parser, specifically in the `mobility opt print()` function within the `print-mobility.c` file.

The issue concerns a buffer over-read in the PGM parser, specifically in the `pgm print()` function within `print-pgm.c`. This could allow a remote attacker to obtain sensitive information by sending a specially crafted request.

The issue is related to a buffer over-read in the IPv6 mobility parser, specifically in the `mobility opt print()` function within the `print-mobility.c` file.

The issue is related to a buffer over-read in the IPv6 mobility parser, specifically in the `mobility opt print()` function within the `print-mobility.c` file.