From 7cb50d31f67f60ec0176e06c050f1e3e172eec16 Mon Sep 17 00:00:00 2001 From: quannguyentm Date: Mon, 5 Jun 2017 10:41:17 -0700 Subject: [PATCH] Fix format bugs.md (#31) * Fix format bugs.md The internal Google format doesn't seem to work with github. * Update bugs.md --- doc/bugs.md | 35 ++++++++++++----------------------- 1 file changed, 12 insertions(+), 23 deletions(-) diff --git a/doc/bugs.md b/doc/bugs.md index f8139ce..ea5e5a1 100644 --- a/doc/bugs.md +++ b/doc/bugs.md @@ -5,15 +5,11 @@ See [list of issues](issues.md) for details. | Summary | Credits | CVE | Upstream Acknowledgement | Tests | |:---------------------------: |:--------------------------:|:-----------------:|:--------------------------------------: |:---------------------------------------: -| Biased DSA, | Daniel Bleichenbacher |CVE-2016-0695 | Oracle Critical Patch Update April 2016 | DsaTest: testDsaBias, | -: leaks signing key : : : : testBiasSha1WithDSA : -| GCM's timing attack, | Quan Nguyen |CVE-2016-3426 | Oracle Critical Patch Update April 2016 | N/A | -: leaks authentication key : : : : : +| Biased DSA, leaks signing key | Daniel Bleichenbacher |CVE-2016-0695 | Oracle Critical Patch Update April 2016 | DsaTest: testDsaBias, testBiasSha1WithDSA | +| GCM's timing attack, leaks auth key | Quan Nguyen |CVE-2016-3426 | Oracle Critical Patch Update April 2016 | N/A | | GCM updateAAD | Quan nguyen | N/A | Oracle Critical Patch Update April 2016 | AesGcmTest: testLateUpdateAAD | -| GCM wrapped around counter, | Quan Nguyen | N/A | Oracle Critical Patch Update April 2016 | AesGcmTest: testWrappedAroundCounter | -: leaks authentication key : : : : : -| DSA | Daniel Bleichenbacher | CVE-2016-5546 | Oracle Critical Patch Update Jan 2017 | DsaTest: testInvalidSignatures | -:ArrayIndexOutOfBoundsException : : : : : +| GCM wrapped around counter, leaks auth key | Quan Nguyen | N/A | Oracle Critical Patch Update April 2016 | AesGcmTest: testWrappedAroundCounter | +| DSA ArrayIndexOutOfBoundsException | Daniel Bleichenbacher | CVE-2016-5546 | Oracle Critical Patch Update Jan 2017 | DsaTest: testInvalidSignatures | | RSA OutOfMemoryError | Daniel Bleichenbacher | CVE-2016-5547 | Oracle Critical Patch Update Jan 2017 | RsaSignatureTest: testVectors | | DSA accepts modified signatures | Daniel Bleichenbacher | CVE-2016-5546 | Oracle Critical Patch Update Jan 2017 | DsaTest: testModifiedSignatures | | DSA Timing Attack | Daniel Bleichenbacher | CVE-2016-5548 | Oracle Critical Patch Update Jan 2017 | DsaTest: testTiming | @@ -26,25 +22,18 @@ See [list of issues](issues.md) for details. |:---------------------------: |:--------------------------:|:-----------------:|:--------------------------------------: |:---------------------------------------: | ECDH Invalid Curve Attack | Daniel Bleichenbacher | N/A | | EcdhTest: multiple tests | | GCM IV reuse | Daniel Bleichenbacher | N/A | | AesGcmTest: testIvReuse | -| GCM weak default tag length | Quan Nguyen | N/A | | AesGcmTest: | -: : : : : testDefaultTagSizeIvParameterSpec : +| GCM weak default tag length | Quan Nguyen | N/A | | AesGcmTest: testDefaultTagSizeIvParameterSpec | ## Package BouncyCastle v1.55 and older | Summary | Credits | CVE | Upstream Acknowledgement | Tests | |:---------------------------: |:--------------------------:|:-----------------:|:--------------------------------------: |:---------------------------------------: -| v1.55 ECDH upstream | Daniel Bleichenbacher | N/A | | Ecdh: multiple tests | -: fix was incomplete : : : : : -| ECDHC Invalid curve attack | Daniel Bleichenbacher | N/A | | EcdhTest: testModifiedPublic, | -: : : : : testModifiedPublicSpec, testWrongOrder : -|v1.55 PKCS #1 RSA is more | Daniel Bleichenbacher | N/A | | RsaTest: testExceptions | -: vulnerable to CCA attack : : : : : +| v1.55 ECDH upstream fix was incomplete | Daniel Bleichenbacher | N/A | | Ecdh: multiple tests | +| ECDHC Invalid curve attack | Daniel Bleichenbacher | N/A | | EcdhTest: testModifiedPublic,testModifiedPublicSpec, testWrongOrder | +| v1.55 PKCS #1 RSA is more vulnerable to CCA attack | Daniel Bleichenbacher | N/A | | RsaTest: testExceptions | | Dhies uses unsafe ECB mode | Daniel Bleichenbacher | CVE-2016-1000344 | | DhiesTest | -| ECIES use unsafe ECB mode | Daniel Bleichenbacher | CVE-2016-1000352 | | EciesTest: testNotEcb, testDefaultEcies| -: by default for "ECIESWithAES" or : : : : : -: "ECIESwithDESede" : : : : : -| 1.52 ECIESWithAES-CBC is | Daniel Bleichenbacher | CVE-2016-1000345 | | EciesTest: testExceptions | -: vulnerable to padding oracle : : : : : +| ECIES use unsafe ECB mode by default for "ECIESWithAES" or "ECIESwithDESede" | Daniel Bleichenbacher | CVE-2016-1000352 | | EciesTest: testNotEcb, testDefaultEcies| +| 1.52 ECIESWithAES-CBC is vulnerable to padding oracle attack | Daniel Bleichenbacher | CVE-2016-1000345 | | EciesTest: testExceptions | | GCM reuses IV after doFinal() | Daniel Bleichenbacher | N/A | | | | ECDSA accepts invalid signatures | Daniel Bleichenbacher | CVE-2016-1000342 | | EcdsaTest: testModifiedSignatures | | DSA accepts invalid signatures | Daniel Bleichenbacher | CVE-2016-1000338 | | DsaTest: testModifiedsignatures | @@ -58,10 +47,10 @@ See [list of issues](issues.md) for details. |:---------------------------: |:--------------------------:|:-----------------:|:--------------------------------------: |:---------------------------------------: | ECDH Invalid Curve Attack | Quan Nguyen | CVE-2016-9121 | $5500 total by Square Inc. for all bugs | To be released | | Multiple signatures, auth bypass | Quan Nguyen | CVE-2016-9122 | | To be released | -| Integer overflow, HMAC bypas | Quan Nguyen | CVE-2016-9123 | | To be released | +| Integer overflow, HMAC bypass | Quan Nguyen | CVE-2016-9123 | | To be released | | Accepts embedded HMAC key | Quan Nguyen | N/A | | To be released | ## Package Go crypto | Summary | Credits | CVE | Upstream Acknowledgement | Tests | |:---------------------------: |:--------------------------:|:-----------------:|:--------------------------------------: |:---------------------------------------: -| GCM wrapped around counter | Quan Nguyen | N/A | https://github.com/golang/go/commit/210ac4d5e0fea2bfd4287b0865104bdaaeaffe05| | +| GCM wrapped around counter | Quan Nguyen | N/A | goo.gl/OdhZcY |