OPENSUSE-SU-2021:0082-1 Security update for nodejs10

This update for nodejs10 fixes the following issues: - New upstream LTS version 10.23.1: CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as...

OPENSUSE-SU-2021:0064-1 Security update for nodejs12

This update for nodejs12 fixes the following issues: - New upstream LTS version 12.20.1: CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as...

Security update for nodejs10 (moderate)

openSUSE Security Update: Security update for nodejs10 Announcement ID: openSUSE-SU-2021:0065-1 Rating: moderate References: 1179491 1180553 1180554 Cross-References: CVE-2020-1971 CVE-2020-8265 CVE-2020-8287 Affected Products: openSUSE Leap 15.2 An update that fixes three vulnerabilities is now...

SUSE-SU-2021:0060-1 Security update for nodejs10

This update for nodejs10 fixes the following issues: - New upstream LTS version 10.23.1: CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as...

Default configuration

An issue was discovered in Veritas CloudPoint before 8.3.0.1+hotfix. The CloudPoint Windows Agent leverages OpenSSL. This OpenSSL library attempts to load the \usr\local\ssl\openssl.cnf configuration file, which does not exist. By default, on Windows systems users can create directories under :. ...

The vulnerability of the OpenSSL library used in the WildFly server, related to uncontrolled resource consumption, allows attackers to cause service failures or gain full access to the system.

The vulnerability of the OpenSSL library used by the WildFly server is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures or gain full access to the system...

Oracle Linux 7 : ELSA-2020-5566-1: / openssl (ELSA-2020-55661)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-55661 advisory. 1.0.2k-21 - remove ASN1FASN1ITEMEMBEDD2I from openssl-1.0.2k-cve-2020-1971.patch 1.0.2k-20 - fix CVE-2020-1971 openssl: EDIPARTYNAME NULL pointer de-reference...

Vulnerability fixed in OpenSSL

A vulnerability has been fixed in OpenSSL. When a remote malicious party manages to provide a rogue certificate and a rogue certificate-revocation-list manages to offer them to an ssl server or ssl client, a denial-of-service can be caused by doing so. OpenSSL has released updates to fix the...

Security Bulletin: OpenSSL vulnerability CVE-2019-1551 impacts IBM Aspera Streaming/IBM Aspera Streaming for Video version 3.9.6.1 and earlier

Summary OpenSSL vulnerability CVE-2019-1551 impacts IBM Aspera Streaming/IBM Aspera Streaming for Video version 3.9.6.1 and earlier. The fix for this set of vulnerabilities was delivered in IBM Aspera High-Speed Transfer Server V4.0.0 and IBM Aspera High-Speed Transfer Endpoint V4.0.0 with...

ALPINE-CVE-2020-1971

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERALNAMEcmp which compares different instances of a GENERALNAME to see if they are equal or not. This function behaves incorrect...

Design/Logic Flaw

NVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a vulnerability in its open-source software dependency in which the OpenSSL library is vulnerable to binary planting attacks by a local user, which may lead to code execution or escalation of privileges...

Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL could allow a local attacker to bypass security restrictions, caused by the building of . mingw programs or Windows programs with world writable path defaults. An attacker...

Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-5407 DESCRIPTION: Simultaneous Multi-threading SMT in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port...

Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability

Summary IBM Security Guardium has addressed the following vulnerability Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: If an application encounters a fatal protocol error and then calls SSLshutdown twice once to send a closenotify, and once to receive one then OpenSSL can respond...

Security Bulletin: IBM Cloud Manager with OpenStack is affected by a OpenSSL vulnerability (CVE-2020-1968)

Summary A security vulnerability has been identified in OpenSSL that is used by Chef. IBM Cloud Manager with OpenStack uses Chef and is affected by this vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM Sterling Connect:Express for UNIX is Affected by an OpenSSL Vulnerability (CVE-2018-0732)

Summary Security vulnerability was disclosed on Jun 12, 2018 by the OpenSSL Project. OpenSSl is used by IBM Sterling Connect:Express for UNIX. IBM Sterling Connect:Express for UNIX has addressed the applicable CVE. Vulnerability Details CVE-ID: CVE-2018-0732 Description: During key agreement in a...

Security Bulletin: OpenSSL Vulnerability Affects IBM Sterling Connect:Express for UNIX (CVE-2019-1559)

Summary A security vulnerability has been disclosed on 26th February 2019 by the OpenSSL Project. OpenSSl is used by IBM Sterling Connect:Express for UNIX. IBM Sterling Connect:Express for UNIX has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: If an...

Security Bulletin: IBM MQ Appliance affected by an OpenSSL vulnerability (CVE-2019-1551)

Summary IBM MQ Appliance has addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x6464 Montgomery squaring procedure used in exponentiation with...

Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Streaming for Video 3.8.0 and earlier (CVE-2019-1552)

Summary The OpenSSL vulnerability CVE-2019-1552 impacts IBM Aspera Streaming for Video 3.8.0 and earlier. The fix was first delivered in IBM Aspera Streaming 3.9.6. Vulnerability Details CVEID: CVE-2019-1552 DESCRIPTION: OpenSSL could allow a local attacker to bypass security restrictions, caused...

The vulnerability of the asn1_d2i_read_bio function (crypto/asn1/a_d2i_fp.c) in the OpenSSL library allows a attacker to cause a service failure.

The vulnerability of the asn1d2ireadbio function crypto/asn1/ad2ifp.c in the OpenSSL library is related to resource management errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...