Moderate: Red Hat Security Advisory: gnutls security and bug fix update

An update for gnutls is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

gnutls: Heap buffer overflow in handshake with no_renegotiation alert sent

A flaw was found in GnuTLS, where the server can trigger the client to run into heap buffer overflow if a norenegotiation alert is sent in an unexpected timing. This flaw allows the client to crash at the session deinitialization timing. The highest threat from this vulnerability is to system...

CURL-CVE-2020-8286 Inferior OCSP verification

libcurl offers "OCSP stapling" via the CURLOPTSSLVERIFYSTATUS option. When set, libcurl verifies the OCSP response that a server responds with as part of the TLS handshake. It then aborts the TLS negotiation if something is wrong with the response. The same feature can be enabled with --cert-stat...

SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2020:2988-1)

This update for gnutls fixes the following issues : Fix heap buffer overflow in handshake with norenegotiation alert sent CVE-2020-24659 bsc1176181 FIPS: Implement ECDH requirements from SP800-56Arev3 bsc1176086 FIPS: Use 2048 bit prime in DH selftest bsc1176086 FIPS: Add TLS KDF selftest...

Security update for wpa_supplicant (moderate)

openSUSE Security Update: Security update for wpasupplicant Announcement ID: openSUSE-SU-2020:2059-1 Rating: moderate References: 1131644 1131868 1131870 1131871 1131872 1131874 1133640 1144443 1150934 1156920 1166933 1167331 930077 930078 930079 Cross-References: CVE-2015-4141 CVE-2015-4142...

Debian DLA-2443-1 : zeromq3 security update

It was discovered that ZeroMQ, a lightweight messaging kernel library does not properly handle connecting peers before a handshake is completed. A remote, unauthenticated client connecting to an application using the libzmq library, running with a socket listening with CURVE...

openSUSE Security Update : apache-commons-httpclient (openSUSE-2020-1873)

This update for apache-commons-httpclient fixes the following issues : - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service HTTPS call hang via unspecified vectors...

openSUSE Security Update : apache-commons-httpclient (openSUSE-2020-1875)

This update for apache-commons-httpclient fixes the following issues : - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service HTTPS call hang via unspecified vectors...

OPENSUSE-SU-2020:1875-1 Security update for apache-commons-httpclient

This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service HTTPS call hang via unspecified vectors...

openSUSE: Security Advisory for apache-commons-httpclient (openSUSE-SU-2020:1873-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for apache-commons-httpclient (important)

openSUSE Security Update: Security update for apache-commons-httpclient Announcement ID: openSUSE-SU-2020:1873-1 Rating: important References: 1178171 945190 Cross-References: CVE-2014-3577 CVE-2015-5262 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now...

Denial Of Service (DoS)

qt5 is vulnerable to denial of service. An incorrect call to SSLshutdown during mid-handshake causes a denial of service condition in TLS applications...

SUSE-SU-2020:3152-1 Security update for apache-commons-httpclient

This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service HTTPS call hang via unspecified vectors...

SUSE-SU-2020:3149-1 Security update for apache-commons-httpclient

This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service HTTPS call hang via unspecified vectors...

qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails...

squid:4 security, bug fix, and enhancement update

An update is available for libecap. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Squid is a high-performance proxy caching server for web clients, supporting...

openSUSE Security Update : gnutls (openSUSE-2020-1743)

This update for gnutls fixes the following issues : - Fix heap buffer overflow in handshake with norenegotiation alert sent CVE-2020-24659 bsc1176181 - FIPS: Implement ECDH requirements from SP800-56Arev3 bsc1176086 - FIPS: Use 2048 bit prime in DH selftest bsc1176086 - FIPS: Add TLS KDF selftest...

Security update for gnutls (moderate)

openSUSE Security Update: Security update for gnutls Announcement ID: openSUSE-SU-2020:1724-1 Rating: moderate References: 1176086 1176181 1176671 Cross-References: CVE-2020-24659 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has two fixes is now available...

MGASA-2020-0379 Updated gnutls packages fix security vulnerability

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the...

Pexip Infinity Denial of Service Vulnerability (CNVD-2020-59043)

Pexip Infinity is video communications software that organizations can deploy in their IT infrastructure, public or private cloud, or any hybrid combination to enable everyone to have their own personal, high-quality video, audio, and mobile conferencing experience. A denial of service...