Security Advisory 0011

Security Advisory 0011 PDF Date: June 17th 2015 Revision| Date| Changes ---|---|--- 1.0 | June 17th, 2015 | Initial release 1.1 | November 4th, 2015 | Updated to reflect versions with the fix for tracked bugs. Change in vulnerability status for CVE-2014-8176 Arista Products Vulnerability report f...

BSA-2015-1935

Security Advisory ID : BSA-2015-1935 Component : TLS protocol 1.2 Revision : 5.0 The TLS protocol 1.2 and earlier, when a DHEEXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHEEXPORT choice, which allows man-in-the-middle attackers to conduct...

DLA-247-1 openssl - security update

Bulletin has no description...

Medium: openssl

Issue Overview: LOGJAM: A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange for both export and non-export grade cipher suites. An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient...

Debian DSA-3287-1 : openssl - security update (Logjam)

Multiple vulnerabilities were discovered in OpenSSL, a Secure Sockets Layer toolkit. - CVE-2014-8176 Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that an invalid memory free could be triggered when buffering DTLS data. This could allow remote attackers to cause a denial of...

Fedora 20 : nss-3.19.1-1.0.fc20 / nss-softokn-3.19.1-1.0.fc20 / nss-util-3.19.1-1.0.fc20 (2015-9161) (Logjam)

Security fix for CVE-2015-4000 Update to the upstream NSS 3.19.1 release, which includes a fix for the recently published logjam attack. The previous 3.19 release made several notable changes related to the TLS protocol, one of them was to disable the SSL 3 protocol by default. For the full list ...

DSA-3287-1 openssl - security update

Bulletin has no description...

Debian Security Advisory DSA 3287-1 (openssl - security update)

Multiple vulnerabilities were discovered in OpenSSL, a Secure Sockets Layer toolkit. CVE-2014-8176 Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that an invalid memory free could be triggered when buffering DTLS data. This could allow remote attackers to cause a denial of...

FreeBSD-SA-15:10.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:10.openssl Security Advisory The FreeBSD Project Topic: Multiple OpenSSL vulnerabilities Category: contrib Module: openssl Announced: 2015-06-12 Affects: All...

FreeBSD : openssl -- multiple vulnerabilities (8305e215-1080-11e5-8ba2-000c2980a9f3) (Logjam)

The OpenSSL team reports : - Missing DHE man-in-the-middle protection Logjam CVE-2015-4000 - Malformed ECParameters causes infinite loop CVE-2015-1788 - Exploitable out-of-bounds read in X509cmptime CVE-2015-1789 - PKCS7 crash with missing EnvelopedContent CVE-2015-1790 - CMS verify infinite loop...

openssl: multiple issues

CVE-2015-1788 denial of service When processing an ECParameters structure OpenSSL enters an infinite loop if the curve specified is over a specially malformed binary polynomial field. This can be used to perform denial of service against any system which processes public keys, certificate...

OpenSSL Patches Multiple Vulnerabilities

OpenSSL has released updates addressing multiple vulnerabilities, one of which allows a remote attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography—an attack known as Logjam CVE-2015-4000. Exploitation of some of these vulnerabilities could allow the attacker to...

OpenSSL Patches Five Flaws, Adds Protection Against Logjam Attack

The OpenSSL project has patched several moderate- and low-severity security vulnerabilities and also has added protection against the Logjam attack in new releases of the software. Most of the vulnerabilities fixed in the new releases are denial-of-service bugs, but one of them can potentially...

Scientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64 (20150604) (Logjam)

A flaw was found in the way the TLS protocol composes the Diffie-Hellman DH key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them do decrypt all traffic. CVE-2015-4000 Note: This update forces the...

Oracle Linux 6 / 7 : openssl (ELSA-2015-1072)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1072 advisory. 1.0.1e-30.9 - fix CVE-2015-4000 - prevent the logjam attack on client - restrict the DH key size to at least 768 bits limit will be increased in future...

OracleVM 3.3 : openssl (OVMSA-2015-0065) (Logjam)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2015-4000 - prevent the logjam attack on client - restrict the DH key size to at least 768 bits limit will be increased in future - drop the AES-GCM restriction of 2^32 operations because the ...

openssl security update

1.0.1e-30.9 - fix CVE-2015-4000 - prevent the logjam attack on client - restrict the DH key size to at least 768 bits limit will be increased in future...

Fedora 22 : nss-3.19.1-1.0.fc22 / nss-softokn-3.19.1-1.0.fc22 / nss-util-3.19.1-1.0.fc22 (2015-9048) (Logjam)

Security fix for CVE-2015-4000 Update to the upstream NSS 3.19.1 release, which includes a fix for the recently published logjam attack. The previous 3.19 release made several notable changes related to the TLS protocol, one of them was to disable the SSL 3 protocol by default. For the full list ...

Fedora 21 : nss-3.19.1-1.0.fc21 / nss-softokn-3.19.1-1.0.fc21 / nss-util-3.19.1-1.0.fc21 (2015-9130) (Logjam)

Security fix for CVE-2015-4000 Update to the upstream NSS 3.19.1 release, which includes a fix for the recently published logjam attack. The previous 3.19 release made several notable changes related to the TLS protocol, one of them was to disable the SSL 3 protocol by default. For the full list ...

Logjam attacks-the new encryption bug affects a large number of users-bug warning-the black bar safety net

Diffie-Hellman key exchange technology is one of the popular encryption algorithm which allows the Internet Protocol uses a shared key and a secure link. It is a multi-Protocol based including HTTPS, SSH, IPsec, SMTPS and some rely on the TLS Protocol. We have found a number of Diffie-Hellman key...