nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state

A protocol downgrade flaw was found in Network Security Services NSS. After a HelloRetryRequest has been sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data...

CVE-2020-15595

CVE-2020-15595 affects Zoho Application Control Plus versions prior to 10.0.511. The issue lies in the Element Configuration feature, which can be abused to retrieve the full list of configured IP ranges and subnets, enabling an attacker to map the internal networks the product can reach. Impact ...

Hacking a Coffee Maker

As expected, IoT devices are filled with vulnerabilities: As a thought experiment, Martin Hron, a researcher at security company Avast, reverse engineered one of the older coffee makers to see what kinds of hacks he could do with it. After just a week of effort, the unqualified answer was: quite ...

EulerOS 2.0 SP8 : trousers (EulerOS-SA-2020-2160)

According to the versions of the trousers packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to...

EulerOS Virtualization for ARM 64 3.0.6.0 : httpd (EulerOS-SA-2020-2018)

According to the versions of the httpd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCECVE-2020-11984 - Apache HTTP Server...

Debian DLA-2376-1 : qtbase-opensource-src security update

Several vulnerabilities were fixed in the Qt toolkit. CVE-2018-19872 A malformed PPM image causes a crash. CVE-2020-17507 Buffer over-read in the XBM parser. For Debian 9 stretch, these problems have been fixed in version 5.7.1+dfsg-3+deb9u3. We recommend that you upgrade your qtbase-opensource-s...

EulerOS Virtualization for ARM 64 3.0.6.0 : python-rsa (EulerOS-SA-2020-2050)

According to the version of the python-rsa package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a...

EulerOS Virtualization for ARM 64 3.0.6.0 : perl-Module-Load-Conditional (EulerOS-SA-2020-2013)

According to the version of the perl-Module-Load-Conditional package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It was found that perl can load modules from the current directory if not found in the module...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2020-2063)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : git (EulerOS-SA-2020-2111)

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git use...

EulerOS 2.0 SP3 : numpy (EulerOS-SA-2020-2083)

According to the version of the numpy packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary...

EulerOS 2.0 SP3 : spamassassin (EulerOS-SA-2020-2118)

According to the version of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.CVE-2018-11781 Note that Tenable Network Security has...

Debian DLA-2381-1 : lua5.3 security update

A vulnerability was discovered in lua5.3, a simple, extensible, embeddable programming language whereby a a negation overflow and segmentation fault could be triggered in getlocal and setlocal, as demonstrated by getlocal3,2^31. For Debian 9 stretch, this problem has been fixed in version...

Fedora 31 : singularity (2020-c1c4cb96d3)

Upgrade to upstream 3.6.3. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

EulerOS 2.0 SP3 : opus (EulerOS-SA-2020-2071)

According to the version of the opus package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An information disclosure vulnerability in silk/NLSFstabilize.c in libopus in Mediaserver could enable a local malicious application to access data...

EulerOS 2.0 SP3 : golang (EulerOS-SA-2020-2078)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, becau...

EulerOS 2.0 SP3 : openssh (EulerOS-SA-2020-2112)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious...

EulerOS 2.0 SP3 : opensc (EulerOS-SA-2020-2066)

According to the versions of the opensc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decodebitstring in libopensc/asn1.c.CVE-2019-15945 - OpenSC before...

Fedora 31 : libxml2 (2020-20ab468a33)

Add fix for CVE-2020-24977 RHBZ1877788. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

EulerOS 2.0 SP3 : ant (EulerOS-SA-2020-2132)

According to the version of the ant package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several...