https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:47:38 +0000 https://db.gcve.eu/vuln/ghsa-69x3-g4r3-p962 <p><strong>Affected:</strong> Go: github.com/slackhq/nebula</p> <p>### Impact</p> <p>When using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint.</p> <p>In order for this to affect a user or network, all of the following must be true: * `CURVE_P256` certificates are being used * There are one or more entries on the blocklist * The certificates for those entries are signed by a trusted CA and not expired * An attacker has a copy of the private key, and corresponding certificate, for one of those blocklist entries</p> <p>### Patches</p> <p>See attached</p> <p>### Workarounds</p> <p>If full copies of each certificate on the existing blocklist are available, it is possible to compute their opposite-chirality signature, and then the appropriate second fingerprint to list in the blocklist.</p> <p>Rotating out all CAs that have signed hosts on the blocklist will also prevent exploitation of this vulnerability.</p> <p><strong>Affected:</strong> Go: github.com/slackhq/nebula</p> <p>### Impact</p> <p>When using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint.</p> <p>In order for this to affect a user or network, all of the following must be true: * `CURVE_P256` certificates are being used * There are one or more entries on the blocklist * The certificates for those entries are signed by a trusted CA and not expired * An attacker has a copy of the private key, and corresponding certificate, for one of those blocklist entries</p> <p>### Patches</p> <p>See attached</p> <p>### Workarounds</p> <p>If full copies of each certificate on the existing blocklist are available, it is possible to compute their opposite-chirality signature, and then the appropriate second fingerprint to list in the blocklist.</p> <p>Rotating out all CAs that have signed hosts on the blocklist will also prevent exploitation of this vulnerability.</p> https://db.gcve.eu/vuln/ghsa-69x3-g4r3-p962