1417 matches found
[SECURITY] Fedora 32 Update: dogtag-pki-10.10.5-1.fc32
Dogtag PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. PKI consists of the following components: Automatic Certificate Management Environment ACME Responder Certificate Authority CA Key Recovery Authority KRA Online Certificate Status...
[SECURITY] Fedora 32 Update: pki-core-10.10.5-1.fc32
Dogtag PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. PKI consists of the following components: Automatic Certificate Management Environment ACME Responder Certificate Authority CA Key Recovery Authority KRA Online Certificate Status...
EulerOS Virtualization for ARM 64 3.0.6.0 : curl (EulerOS-SA-2021-1548)
According to the versions of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificatio...
EulerOS 2.0 SP8 : curl (EulerOS-SA-2021-1137)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP...
OSV-2021-147 Use-of-uninitialized-value in gnutls_ocsp_resp_get_status
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1492 Crash type: Use-of-uninitialized-value Crash state: gnutlsocsprespgetstatus gnutlsocsprespimport start...
PT-2021-27862
Name of the Vulnerable Software and Affected Versions GnuTLS affected versions not specified Description The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the gnutls ocsp resp get status and gnutls ocsp resp import functions. Recommendations At the...
go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curve
The Go project reports: The go command may execute arbitrary code at build time when cgo is in use on Windows. This may occur when running "go get", or any other command that builds code. Only users who build untrusted code and don't execute it are affected. In addition to Windows users, this can...
USN-4665-1: curl vulnerabilities | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Marc Aldorasi discovered that curl incorrectly handled the libcurl CURLOPTCONNECTONLY option. This could result in data being sent to the wrong destination, possibly exposing...
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2021-1003)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-1003)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match...
EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-1022)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match...
Updated curl packages fix security vulnerabilities
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. CVE-2020-8231. A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl...
Debian DLA-2500-1 : curl security update
Several vulnerabilities were discovered in curl, a command line tool for transferring data with URL syntax and an easy-to-use client-side URL transfer library. CVE-2020-8284 When curl performs a passive FTP transfer, it first tries the EPSV command and if that is not supported, it falls back to...
[SECURITY] [DLA 2500-1] curl security update
Debian LTS Advisory DLA-2500-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez December 18, 2020 https://wiki.debian.org/LTS Package : curl Version : 7.52.1-5+deb9u13 CVE ID : CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 Debian Bug : 977161 977162 977163 Several...
Haxx libcurl trust management issue vulnerability
Haxx libcurl is an open source client-side URL transport library from the Swedish company Haxx. It supports protocols such as FTP, SFTP, TFTP and HTTP. Haxx libcurl suffers from a trust management issue vulnerability that can be exploited by an attacker to act as a man-in-the-middle by performing...
Fedora 33 : curl (2020-ceaf490686)
curl: Inferior OCSP verification CVE-2020-8286 - libcurl: FTP wildcard stack overflow CVE-2020-8285 - curl: trusting FTP PASV responses CVE-2020-8284 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...
CVE-2020-8286
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response...
CVE-2020-8286
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response...
