Security Bulletin: This Power System update is being released to address CVE-2018-0732

Summary POWER9: In response to a denial of service vulnerability in OpenSSL, a new Power Systems firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-0732. A malicious server can send a large prime value to a client during DHE TLS handshake causi...

Security Bulletin: IBM MQ for HP NonStop Server is affected by OpenSSL vulnerability CVE-2021-3711

Summary A buffer overflow issue described by CVE-2021-3711 was identified in the OpenSSL component of IBM MQ. Vulnerability Details CVEID: CVE-2021-3711 DESCRIPTION: OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the EVPPKEYdecrypt function within implementation...

F5 Networks BIG-IP : OpenSSL vulnerability (K24624116)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4.6 / 15.1.5.1 / 16.1.2.2 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K24624116 advisory. Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length...

Security Bulletin: Aspera Web Applications (Shares, Console) are affected by an OpenSSL Vulnerability (CVE-2020-1971)

Summary Aspera Web Applications Shares, Console have addressed the following OpenSSL Vulnerability. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, a...

Security Bulletin: OpenSSL Vulnerability Affects IBM Sterling Connect:Express for UNIX (CVE-2021-3712)

Summary Security vulnerability have been disclosed on 24th August 2021 by the OpenSSL Project. OpenSSl is used by IBM Sterling Connect:Express for UNIX. IBM Sterling Connect:Express for UNIX has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-3712 DESCRIPTION: OpenSSL could...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL and Node.js vulnerabilities (CVE-2020-1971, CVE-2020-8287, CVE-2020-8265)

Summary IBM Cloud Private is vulnerable to OpenSSL and Node.js vulnerabilities Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker could...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL vulnerabilities (CVE-2020-1971 )

Summary IBM Cloud Private is vulnerable to OpenSSL vulnerabilities Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker could exploit this...

OpenSSL: DoS Vulnerability (CVE-2006-7250) - Windows

OpenSSL is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

CVE-2021-34581

Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthenticated attacker to cause DoS on the device...

WAGO 安全漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. This device is designed for applications in industrial environments where digital algorithms operate electronic systems. A security vulnerability in the OpenSSL implementation of the WAGO 750-831/xxx xxx, 750-880/xxx xxx,...

SUSE SLES15: libopenssl-1_1-devel / libopenssl1_1 / libopenssl1_1-32bit / etc (SUSE-SU-2021:2829-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2829-1 advisory. This update for openssl-11 fixes the following security issue: - CVE-2021-3712: a bug in the code for printing certificate details could lea...

SUSE-SU-2021:14792-1 Security update for openssl1

This update for openssl1 fixes the following security issue: - CVE-2021-3712: a bug in the code for printing certificate details could lead to a buffer overrun that a malicious actor could exploit to crash the application, causing a denial-of-service attack. bsc1189521...

PT-2021-4043

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1 through 1.1.1k OpenSSL versions 1.0.2 through 1.0.2y Description The issue is related to the representation of ASN.1 strings within OpenSSL as an ASN1 STRING structure, which contains a buffer holding the string data and...

PT-2021-4042

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1 through 1.1.1k Description The issue is related to a buffer overflow in the SM2 decryption code. When an application calls the EVP PKEY decrypt function to decrypt SM2 encrypted data, a bug in the implementation can caus...

CVE-2021-3711

In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size...

F5 Networks BIG-IP : OpenSSL vulnerability (K42910051)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4.4 / 15.1.4.1 / 16.1.2. It is, therefore, affected by a vulnerability as referenced in the K42910051 advisory. The X.509 GeneralName type is a generic type for representing different types of names. One of those name...

Security Bulletin: Update Secure Gateway Client in IBM DataPower Gateway to address several CVEs

Summary Update the version of Node used by Secure Gateway Client component to address the listed CVEs. This issue affects only users of the Secure Gateway Client. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer...

Security Bulletin: Potential DoS in IBM DataPower Gateway

Summary IBM has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-3449 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signaturealgorithms processing. By sending a specially crafted renegotiation ClientHello message from a clien...

Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities (CVE-2020-1971, CVE-2020-15999, CVE-2017-12652)

Summary IBM Security Privileged Identity Manager has addressed several security issues as follows. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an...

Security Bulletin: Vulnerability in Fabric OS used by IBM b-type SAN directors and switches.

Summary Public disclosed vulnerability from OpenSSL in the Fabric OS used by IBM b-type SAN directors and switches. Vulnerability Details CVEID: CVE-2021-3449 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signaturealgorithms processing. By...