UBUNTU-CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2021-3336

CVE-2021-3336 affects wolfSSL (tls13.c: DoTls13CertificateVerify) prior to version 4.7.0, where processing is not ceased for certain anomalous peer behavior (signature types ED22519, ED448, ECC, or RSA) without the corresponding certificate. This can allow MITM attackers to impersonate TLS 1.3 se...

CentOS 8 : nss and nspr (CESA-2019:1951)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1951 advisory. - nss: NULL pointer dereference in several CMS functions resulting in a denial of service CVE-2018-18508 - nss: Out-of-bounds read when importing...

Security update for stunnel (moderate)

openSUSE Security Update: Security update for stunnel Announcement ID: openSUSE-SU-2021:0160-1 Rating: moderate References: 1177580 1178533 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for stunnel fixes the following...

WordPress Process Steps Template Designer plugin <= 1.2.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress Process Steps Template Designer plugin versions = 1.2.1. Solution Update the WordPress Process Steps Template Designer plugin to the latest available version at least 1.3...

Mozilla Network Security Service (NSS): Denial of service

Background The Mozilla Network Security Service NSS is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. Description A flaw was found in the way Mozilla Network Security Service NSS handled CCS ChangeCipherSpec message...

Oracle Linux 8 : gnutls (ELSA-2020-5483)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5483 advisory. 3.6.14-7 - Increase DH key bits to = 2048 in self-tests 1879506 - Implement self-tests for KDF and CMAC 1890870 - Fix CVE-2020-24659: heap buffer-overflow when...

EulerOS 2.0 SP5 : nss (EulerOS-SA-2020-2572)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages,...

Design/Logic Flaw

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5...

Exploit for Incorrect Resource Transfer Between Spheres in Linuxfoundation Containerd

ABSTRACT SHIMMER CVE-2020-15257 This repo contains proof-of...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS. The vulnerability exists through the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3...

EulerOS 2.0 SP9 : nss (EulerOS-SA-2020-2500)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability...

Huawei EulerOS: Security Advisory for nss (EulerOS-SA-2020-2487)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for nss (EulerOS-SA-2020-2500)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : nss (EulerOS-SA-2020-2478)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages,...

SUSE-SU-2020:3460-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: - Fix regression '8250861: Crash in MinINode::IdealPhaseGVN, bool', introduced in October 2020 CPU. - Update to version jdk8u272 icedtea 3.17.0 July 2020 CPU, bsc1174157, and October 2020 CPU, bsc1177943 New features + JDK-8245468: Add...

Amazon Linux 2 : nspr, nss-softokn, nss-util, nss (ALAS-2020-1559)

The version of nspr installed on the remote host is prior to 4.25.0-2. The version of nss installed on the remote host is prior to 3.53.1-3. The version of nss-softokn installed on the remote host is prior to 3.53.1-6. The version of nss- util installed on the remote host is prior to 3.53.1-1. It...