CVE-2020-27276

SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't use adequate measures to authenticate the communicating entities before exchanging keys, which allows unauthenticated, physically proximate...

SUSE SLES12 Security Update : openssh (SUSE-SU-2021:0022-1)

This update for openssh fixes the following issues : CVE-2020-14145: Fixed a potential information leak during host key exchange bsc1173513. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

NSA Releases Guidance on Eliminating Obsolete TLS Protocol Configurations

The National Security Agency NSA has released a Cybersecurity Information CSI sheet on eliminating obsolete Transport Layer Security TLS configurations. The information sheet identifies strategies to detect obsolete cipher suites and key exchange mechanisms, discusses recommended TLS...

PYSEC-2020-143

tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS1 v1.5 decryption is data dependant. In particular, the code has multiple ways in...

CVE-2020-26263

tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS1 v1.5 decryption is data dependant. In particular, the code has multiple ways in...

Security update for openssh (moderate)

openSUSE Security Update: Security update for openssh Announcement ID: openSUSE-SU-2020:2298-1 Rating: moderate References: 1115550 1139398 1142000 1148566 1173513 1174162 Cross-References: CVE-2020-14145 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has 5 fixe...

SUSE-SU-2020:3882-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2020-14145: Fixed a potential information leak during host key exchange bsc1173513. - Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted bsc1148566...

SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2020:3736-1)

This update for openssh fixes the following issues : CVE-2020-14145: Fixed a potential information leak during host key exchange bsc1173513. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE-SU-2020:3736-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2020-14145: Fixed a potential information leak during host key exchange bsc1173513...

The vulnerability of the ikev1_n_print() function in the tcpdump network traffic capture and analysis tool allows a hacker to induce a service failure.

The vulnerability of the ikev1nprint function print-isakmp.c, a utility for capturing and analyzing network traffic using tcpdump, is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Input validation

A vulnerability in the TLS handler of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to...

CVE-2020-3585 Cisco Firepower 1000 Series Bleichenbacher Attack Vulnerability

A vulnerability in the TLS handler of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to...

CVE-2020-3585 Cisco Firepower 1000 Series Bleichenbacher Attack Vulnerability

A vulnerability in the TLS handler of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to...

EulerOS 2.0 SP3 : openssl098e (EulerOS-SA-2020-2076)

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The PKCS7dataDecodefunction in crypto/pkcs7/pk7doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before...

MGASA-2020-0370 Updated mbedtls packages fix security vulnerabilities

mbedtls 2.16.8 fixes three security vulnerabilities which could affect earlier releases: Local side channel attack on classical CBC decryption in DTLS CVE-2020-16150. Local side channel attack on RSA and static Diffie-Hellman. Protocol weakness in DHE-PSK key exchange...

Updated mbedtls packages fix security vulnerabilities

mbedtls 2.16.8 fixes three security vulnerabilities which could affect earlier releases: Local side channel attack on classical CBC decryption in DTLS CVE-2020-16150. Local side channel attack on RSA and static Diffie-Hellman. Protocol weakness in DHE-PSK key exchange...

Arbitrary Memory Overwrite

putty is vulnerable to arbitrary memory overwrite. A remote attacker is able to exploit the vulnerability to write arbitrary data into memory during the RSA key exchange before host key verification...

Security Bulletin: A vulnerability in IBM Java SDK affects Rational Software Architect for WebSphere Software (CVE-2014-4263)

Summary The JSSE component's Diffie-Hellman key exchange implementation is vulnerable to a man-in-the-middle attack. The fix adds a new check to prevent the attack. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link...

New Raccoon Attack Could Let Attackers Break SSL/TLS Encryption

A group of researchers has detailed a new timing vulnerability in Transport Layer Security TLS protocol that could potentially allow an attacker to break the encryption and read sensitive communication under specific conditions. Dubbed "Raccoon Attack," the server-side attack exploits a...

SolarWinds DameWare Mini Remote Control < 12.1.1 Denial of Service

The remote host is running a version of SolarWinds DameWare Mini Remote Control prior to 12.1.1. It is, therefore, affected by a denial of service vulnerability. A classic buffer overflow allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' duri...