OESA-2024-1914 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent ...

Amazon Linux 2 : edk2 (ALAS-2024-2591)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2591 advisory. Issue summary: Calling the OpenSSL API function SSLselectnextproto with anempty supported client protocols buffer may cause a crash or memory contents tobe sent to the peer. Impact summary: A buffer...

Medium: edk2

Issue Overview: Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected applicati...

CVE-2024-5642

A vulnerability was found in Python/CPython that does not disallow configuring an empty list "" for SSLContext.setnpnprotocols, which is an invalid value for the underlying OpenSSL API. This issue results in a buffer over-read when NPN is used. See CVE -2024-5535 for OpenSSL for more information...

CVE-2024-5642

CPython 3.9 and earlier doesn't disallow configuring an empty list "" for SSLContext.setnpnprotocols which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used see CVE-2024-5535 for OpenSSL. This vulnerability is of low severity due to NPN being...

CVE-2024-5642

CPython 3.9 and earlier doesn't disallow configuring an empty list "" for SSLContext.setnpnprotocols which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used see CVE-2024-5535 for OpenSSL. This vulnerability is of low severity due to NPN being...

CVE-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols()

CPython 3.9 and earlier doesn't disallow configuring an empty list "" for SSLContext.setnpnprotocols which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used see CVE-2024-5535 for OpenSSL. This vulnerability is of low severity due to NPN being...

CVE-2024-5642

CVE-2024-5642 affects CPython 3.9 and earlier where CPython allows an empty list for SSLContext.set_npn_protocols(), an invalid value for the OpenSSL API. The underlying issue is a buffer over-read when NPN is used, related to CVE-2024-5535 (OpenSSL). The vulnerability is characterized as low sev...

CVE-2024-5535

Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or ...

CVE-2024-5535

CBL-Mariner advisory CVE-2024-5535 affects package hvloader for versions older than 1.0.1-6. An upgraded hvloader (1.0.1-6 or newer) resolves the issue. The advisory notes that a newer version is available to address the vulnerability.

CVE-2024-5535 SSL_select_next_proto buffer overread

Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or ...

CVE-2024-5535

Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or ...

OpenSSL 3.1.0 < 3.1.7 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.1.7. It is, therefore, affected by a vulnerability as referenced in the 3.1.7 advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memor...

OpenSSL 1.1.1 < 1.1.1za Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.1.1za. It is, therefore, affected by a vulnerability as referenced in the 1.1.1za advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or...

OpenSSL 3.3.0 < 3.3.2 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.3.2. It is, therefore, affected by a vulnerability as referenced in the 3.3.2 advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memor...

SSL/TLS: NPN / ALPN Extension and Protocol Support Detection

This routine identifies services supporting the following extensions to TLS: - Application-Layer Protocol Negotiation ALPN - Next Protocol Negotiation NPN. Based on the availability of this extensions the supported Network Protocols by this service are gathered and reported. SPDX-FileCopyrightTex...

HAProxy 1.6.x < 1.6.4 Multiple Vulnerabilities

Binary data 9965.prm...

TLS NPN Supported Protocol Enumeration

The remote host supports the TLS NPN Transport Layer Security Next Protocol Negotiation extension. This plugin enumerates the protocols the extension supports. TRUSTED...

WinRadius 2.11 - Denial of Service Vulnerability

Exploit for windows platform in category dos / poc !/usr/bin/python Exploit Title: WinRadius 2.11 DoS Date: 10th June 2013 Exploit Author: npn Exploit Author Homepage: http://www.iodigitalsec.com/ Exploit Author Write Up: http://www.iodigitalsec.com/blog/fuzz-to-denial-of-service-winradius-2-11/...

Quick TFTP Server Pro 2.2 - Denial of Service

!/usr/bin/python Exploit Title: Quick TFTP Server 2.2 DoS Date: 6th June 2013 Exploit Author: npn Exploit Author Homepage: http://www.iodigitalsec.com/ Exploit Author Write Up: http://www.iodigitalsec.com/blog/fuzz-to-denial-of-service-quick-tftp-server-2-2/ Vendor Homepage:...