Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL

Summary IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL CVE-2023-2975. The resolving fix contains node.js 18.17.1 which includes OpenSSL v3.0.10.0+quic1 Vulnerability Details CVEID:CVE-2023-2975 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security...

Medium: openssl-snapsafe

Issue Overview: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being...

GHSA-V8GR-M533-GHJ9 Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt. If you...

OpenSSL 3.1.0 < 3.1.3 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.1.3. It is, therefore, affected by a vulnerability as referenced in the 3.1.3 advisory. - Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applicatio...

CVE-2023-4807 POLY1305 MAC implementation corrupts XMM registers on Windows

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses...

Security Bulletin: IBM Storage Insights is vulnerable to weaknesses related to OpenSSL

Summary Vulnerability in OpenSSL may affect IBM Storage Insights. Vulnerability Details CVEID:CVE-2023-2650 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using OBJobj2txt directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with ...

Oracle Linux 6 : openssl (ELSA-2011-0677)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0677 advisory. - fix OCSP stapling vulnerability - CVE-2011-0014 676063 - disable code for SSLOPNETSCAPEREUSECIPHERCHANGEBUG - CVE-2010-3864 649304 Tenable has extracted the...

Security Bulletin: IBM MQ Appliance potentially vulnerable to a denial of service (CVE-2023-2650)

Summary IBM MQ Appliance has addressed a denial of service vulnerability. Vulnerability Details CVEID:CVE-2023-2650 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using OBJobj2txt directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or ...

SUSE-SU-2023:3308-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2023-3817: Fixed a potential DoS due to excessive time spent checking DH q parameter value. bsc1213853...

Vulnerabilities fixed in Python

Vulnerabilities have been fixed in Python. In addition to the vulnerabilities in OpenSSL, for which the NCSC has published previous security advisories published, a vulnerability has also been fixed in the urllib.parse component. Because proper input validation does not take place, it is possible...

Security Bulletin: IBM Elastic Storage System is affected by a vulnerability in OpenSSL (CVE-2022-4450)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVEID:CVE-2022-4450 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error related to the improper handling of specific PEM data by the PEMreadbioex function. By sending...

Dell PowerVault ME5 OpenSSL (DSA-2023-083)

The version of Dell PowerVault ME5 installed on the remote host is prior to ME5.1.1.0.5. It is, therefore, affected by a vulnerability as referenced in the DSA-2023-018 advisory. - Dell PowerVault ME5 remediation is available for an OpenSSL vulnerability that may be exploited by malicious users t...

PT-2023-4554

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.0 OpenSSL versions prior to 3.1 Description The issue is related to the functions DH check, DH check ex, and EVP PKEY param check in the OpenSSL library. These functions can cause excessive delays when checking...

SUSE-SU-2023:3012-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2023-3446: Fixed DHcheck excessive time with over sized modulus bsc1213487...

EulerOS Virtualization 3.0.6.6 : shim-signed (EulerOS-SA-2023-2436)

According to the versions of the shim-signed packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used...

[R1] Stand-alone Security Patch Available for Security Center versions 6.0.0, 6.1.0 and 6.1.1: SC-202307.1-6.x

R1 Stand-alone Security Patch Available for Security Center versions 6.0.0, 6.1.0 and 6.1.1: SC-202307.1-6.x Arnie Cabral Tue, 07/25/2023 - 11:30 Tenable Security Center leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to...

Medium: openssl-snapsafe

Issue Overview: A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it ...

CVE-2023-3446 Excessive time spent checking DH keys and parameters

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

CVE-2023-2975 AES-SIV implementation ignores empty associated data entries

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

Security Bulletin: IBM Decision Optimization in IBM Cloud Pak for Data is vulnerable to OpenSSL denial of service (Cryptography package)

Summary There is a potential OpenSSL denial of service vulnerability in IBM Decision Optimization in IBM Cloud Pak for Data. IBM Decision Optimization in IBM Cloud Pak for Data has addressed the vulnerability. Vulnerability Details CVEID:CVE-2023-0286 DESCRIPTION: OpenSSL is vulnerable to a denia...