PT-2021-2046 · Microsoft +3 · Net Core +4

Name of the Vulnerable Software and Affected Versions: .NET Core and Visual Studio affected versions not specified Description: The issue is related to insufficient input validation, which can be exploited by a remote attacker to cause a denial of service. This vulnerability exists when creating...

Security Update for .NET Core (February 2021)

The Microsoft .NET Core installation on the remote host is version 2.1.x prior to 2.1.25, 3.1.x prior to 3.1.126, or 5.x prior to 5.0.3. It is, therefore, affected by a denial of service vulnerability when creating HTTPS web requests during X509 certificate chain building. An unauthenticated,...

Security Update for .NET Core (February 2021) (macOS)

The Microsoft .NET Core runtime installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists in .NET Core when creating HTTPS web requests during X509 certificate chain building. An...

CVE-2020-27222

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based x509 and RPK DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch...

Code injection

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based x509 and RPK DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch...

CVE-2020-27222

CVE-2020-27222 affects the Eclipse Californium DTLS implementation. Versions 2.3.0 through 2.6.0 experience a certificate-based DTLS handshake failure caused by the server persisting a wrong internal state after a prior handshake failure with TLS parameter mismatch. This state corruption allows a...

kernel security, bug fix, and enhancement update

3.10.0-1160.15.2.OL7 - Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 = 15-2.0.3 3.10.0-1160.15.2 - fs nfs: Fix...

A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element resulting in denial of service.

...

A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring resulting in denial of service.

...

DEBIAN-CVE-2020-36229

A flaw was discovered in ldapX509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in adkeystring, resulting in denial of service...

PT-2021-5550

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.57 Description The issue is related to an assertion failure during syntactic analysis in the OpenLDAP implementation, which can be exploited by a remote attacker to cause a denial of service DoS by sending a...

Improper Verification Of Cryptographic Signature

pysaml2 improperly verifies cryptographic signatures. The default CryptoBackendXmlSec1 using the xmlsec1 binary incorrectly accepts any type of key found in the given document, instead of explicitly allowing only x509 certificates for verification...

Design/Logic Flaw

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does no...

PYSEC-2021-49

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does no...

CVE-2021-21239

CVE-2021-21239 affects PySAML2 (pre-6.5.0) and stems from improper verification of SAML signatures when using the default CryptoBackendXmlSec1 backend. The underlying xmlsec1 verification can accept arbitrary keys embedded in the document instead of restricting to trusted IdP certificates, enabli...

GHSA-5P3X-R448-PC62 Improper Verification of Cryptographic Signature in PySAML2

Impact All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. pysaml2 = 6.4.1 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the...

Improper Verification of Cryptographic Signature in PySAML2

Impact All users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. pysaml2 = 6.4.1 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the...

EulerOS 2.0 SP3 : openssl (EulerOS-SA-2021-1104)

According to the version of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL...

OSV-2018-121 Use-of-uninitialized-value in _gnutls_x509_read_pkalgo_params

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10135 Crash type: Use-of-uninitialized-value Crash state: gnutlsx509readpkalgoparams printcrtpubkey printcert...

go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve

The Go project reports: The go command may execute arbitrary code at build time when cgo is in use on Windows. This may occur when running "go get", or any other command that builds code. Only users who build untrusted code and don't execute it are affected. In addition to Windows users, this can...