March 2025 - rwth-security - lists.rwth-aachen.de

Next.js and the corrupt middleware: the authorizing artifact
by Bernd Kohler 23 Mar '25

23 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Next.js and the corrupt middleware: the authorizing artifact" --> "How to find Next.js on your network" [1] --> "... Exploitation is trivial and can be achieved by sending an extra HTTP header of `x-middleware-subrequest: true` ..." --> "CVE-2025-29927 is rated critical with a CVSSv3 base score of 9.1." VG Bernd [0] https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-… [1] https://www.runzero.com/blog/next-js/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

UK NCSC (National Cyber Security Centre) - roadmap for post-quantum cryptography migration
by Bernd Kohler 22 Mar '25

22 Mar '25

sofern nicht selber schon gesehen/-lesen hier [0] FYI "Cyber chiefs unveil new roadmap for post-quantum cryptography migration" To 2028 identify cryptographic services needing upgrades and build a migration plan. From 2028 to 2031 – execute high-priority upgrades and refine plans as PQC evolves. From 2031 to 2035 – complete migration to PQC for all systems, services and products. VG Bernd [0] https://www.ncsc.gov.uk/news/pqc-migration-roadmap-unveiled -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Linux Security Hardening Cache Randomization Was Inadvertently Using The Same Seed
by Bernd Kohler 22 Mar '25

22 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Linux Security Hardening Cache Randomization Was Inadvertently Using The Same Seed" VG Bernd [0] https://www.phoronix.com/news/Linux-6.15-slab -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Finding bugs in implementations of HQC, the fifth post-quantum standard
by Bernd Kohler 22 Mar '25

22 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Finding bugs in implementations of HQC, the fifth post-quantum standard" VG Bernd [0] https://blog.quarkslab.com/finding-bugs-in-implementations-of-hqc-the-fifth… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Starshields for iOS: Navigating the Security Cosmos in Satellite Communication
by Bernd Kohler 21 Mar '25

21 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Starshields for iOS: Navigating the Security Cosmos in Satellite Communication" --> gefunden via [1] (kompletter Beitrag nur nach Anmeldung) VG Bernd [0] https://www.ndss-symposium.org/wp-content/uploads/2025-124-paper.pdf [1] https://www.linkedin.com/posts/dlaskov_technology-hacking-security-activity… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Supply Chain Attacks on Linux distributions - Overview
by Bernd Kohler 19 Mar '25

19 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Supply Chain Attacks on Linux distributions - Overview" VG Bernd [0] https://fenrisk.com/supply-chain-attacks -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Linux Password Hash Risk
by Bernd Kohler 19 Mar '25

19 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Linux Password Hash Risk" --> siehe dazu auch [1] VG Bernd [0] https://sandflysecurity.com/sharing/linux-password-hash-risks.pdf [1] https://gist.github.com/ZephrFish/086b1700912cfedd9800405373a210fd -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

HP Launches Printers with Quantum Resilient Cryptography
by Bernd Kohler 18 Mar '25

18 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "HP Launches Printers with Quantum Resilient Cryptography" VG Bernd [0] https://www.securityweek.com/hp-launches-printers-with-quantum-resilient-cr… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Unpatched Windows Zero-Day Flaw Exploited by 11 State-Sponsored Threat Groups Since 2017
by Bernd Kohler 18 Mar '25

18 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Unpatched Windows Zero-Day Flaw Exploited by 11 State-Sponsored Threat Groups Since 2017" VG Bernd [0] https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

NIST Announces HQC as Fifth Standardized Post Quantum Algorithm
by Bernd Kohler 18 Mar '25

18 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "NIST Announces HQC as Fifth Standardized Post Quantum Algorithm" VG Bernd [0] https://www.securityweek.com/nist-announces-hqc-as-fifth-standardized-post-… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0