UBUNTU-CVE-2022-1434

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipie...

CVE-2022-24759 Failure to validate signature during handshake in @chainsafe/libp2p-noise

@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...

californium-core: DTLS - DoS vulnerability for certificate based handshakes

A flaw was found in californium. The certificate based x509 and RPK DTLS handshakes fails due to the DTLS server side being set to a wrong internal state by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The highest threat from this vulnerability is to system...

EulerOS Virtualization for ARM 64 3.0.6.0 : gnutls (EulerOS-SA-2021-1582)

According to the version of the gnutls packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a...

Unable to use TLS/SSL LDAP Auth after ADM upgrade to latest build 13.0-71.40 - TLS Handshake fails with "Unknown CA"

After upgrading ADM to latest build 13.0-71.40 External Authentication fails when LDAP Server is configured using Security type SSL and TLS. When retrieving Attributes on LDAP Server config from ADM GUI throw this error :: "LDAP IP Address or Port Number provided is invalid." Network trace shows...

Oracle Linux 8 : gnutls (ELSA-2020-5483)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5483 advisory. 3.6.14-7 - Increase DH key bits to = 2048 in self-tests 1879506 - Implement self-tests for KDF and CMAC 1890870 - Fix CVE-2020-24659: heap buffer-overflow when...

MGASA-2020-0379 Updated gnutls packages fix security vulnerability

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the...

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing and then an invalid second handshake occurs. The crash happens in the application's error handling path where the gnutls_deinit function is called after detecting a handshake failure.

...

CVE-2020-24659

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the...

CVE-2020-24659

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the...

GnuTLS -- null pointer dereference

The GnuTLS project reports: It was found by oss-fuzz that the server sending a "norenegotiation" alert in an unexpected timing, followed by an invalid second handshake can cause a TLS 1.3 client to crash via a null-pointer dereference. The crash happens in the application's error handling path,...

CVE-2020-14483

A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart of Niagara Versions 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110 and Niagara Enterprise Security Versions 2.4.31, 2.4.45, 4.8.0.35 to corre...

TLS handshake fails with any TLS LB VIP FIPS 9700 - Reset code 9811 from ADC

Cannot reach Netscaler Gateway Page FIPS Not able to form any TLS handshake with any LB VIP on ADC ADC sends REST with code :: 9811 Transmission Control Protocol, Src Port: 443, Dst Port: 62706, Seq: 4271, Ack: 860, Len: 0 Source Port: 443 Destination Port: 62706 Stream index: 0 TCP Segment Len: ...

Remote SSL Peer sent a handshake failure- on CWA 1910 for Mac and macOS Catalina

When trying to connect user receives "The remote SSL peer sent a handshake failure alert"...

CVE-2017-7805

During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer...

SSL Handshake Fails When Server Name Indication (SNI) is Enabled on ADC

SSL handshake fails when Server Name Indication feature is enabled on NetScaler Server Name Indication aka SNI is an extension of the TLS protocol. For SNI to work, the server name in the client hello must match the host name configured on the back-end service that is bound to an SSL virtual...

UBUNTU-CVE-2017-15896

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSLread due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption...

SSL Handshake Failure on ADC Because of Unsupported Ciphers

SSL connection failsbetween the client and the ADCappliance ADC responds with a fatal alert. The description of the alert message is “Handshake Failure 40”. The above screenshot is from a NetScaler trace packet capture. Procedure to run a trace on the ADC is explained in the following document:...

openSUSE Security Update : mbedtls (openSUSE-2015-898)

This update for mbedtls fixes the following security and non-security issues : - Update to 1.3.15 - Fix potential double free if sslsetpsk is called more than once and some allocation fails. Cannot be forced remotely. Found by Guido Vranken, Intelworks. - Fix potential heap corruption on windows...

dovecot: denial of service

Dovecot = 2.2.14 does not correctly handle SSL/TLS handshake failure in the login process, asking OpenSSL to flush a connection that has already been aborted. This results in a crash with some versions of OpenSSL most likely = 1.0.2. A patch to OpenSSL has also been written to handle more...