OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with...

TLS Session Resumption Client Certificate Bypass

libcurl.so is vulnerable to TLS session resumption client certificate bypass attacks. The vulnerability exists in Curlclonesslconfig of lib/vtls/vtls.c where libcurl.so does not prevent the TLS session resumption if the client certificate has been replaced...

CVE-2017-7468

In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which...

CVE-2017-7468

CVE-2017-7468 affects curl/libcurl (7.52.0–7.53.1): TLS session resumption could reuse an old client identity when the client cert changed, bypassing certificate checks. Upstream fix released in 7.54.0; Arch Linux/CentOS advisories note the remediation and recommend upgrading to 7.54.0 or later. ...

CVE-2017-7468

In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which...

Fedora 27 : knot-resolver (2018-50d055a5af)

Knot Resolver 2.4.0 2018-07-03 ================================ Incompatible changes -------------------- - minimal libknot version is now 2.6.7 to pull in latest fixes 366 Security -------- - fix a rare case of zones incorrectly dowgraded to insecure status !576 New features ------------ - TLS...

Security Bulletin: IBM Rational ClearCase CCRC WAN Server remote denial of service (CVE-2013-6329)

Summary A vulnerability in relation to SSL/TLS Handshake Processing has been discovered related to the SSLV3 Session Resumption when using SSLV2. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more informati...

Security Bulletin: CM OnDemand GSKit Vulnerability (CVE-2013-6329)

Summary A vulnerability exists in IBM Global Security Kit GSKit that is shipped with Content Manager OnDemand. Vulnerability Details CVEID: CVE-2013-6329 DESCRIPTION: A vulnerability in relation to SSL/TLS Handshake Processing has been discovered related to the SSLV3 Session Resumption when using...

Security Bulletin: Potential SSL/TLS-related denial of service vulnerability in IBM Informix Client SDK (CVE-2013-6329)

Summary Informix Client SDK is impacted by a vulnerability in IBM's GSKIT library which can result in a denial of service caused by an error in SSL/TLS handshake processing related to session resumption when using SSLv2. A remote attacker could exploit this vulnerability to cause the system to...

WebKit - Use-After-Free when Resuming Generator

WebKit - Use-After-Free when Resuming Generator !-- In WebKit, resuming a generator is implemented in JavaScript. An internal object property, @generatorState is used to prevent recursion within generators. In GeneratorPrototype.js, the state is checked by calling: var state = this.@generatorStat...

CentOS Update for freeradius CESA-2017:1581 centos7

Check the version of freeradius SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882745";...

CentOS 7 : freeradius (CESA-2017:1581)

An update for freeradius is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

freeradius security update

CentOS Errata and Security Advisory CESA-2017:1581 An update for freeradius is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Important: Red Hat Security Advisory: freeradius security update

An update for freeradius is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

freeradius: TLS resumption authentication bypass

An authentication bypass flaw was found in the way the EAP module in FreeRADIUS handled TLS session resumption. A remote unauthenticated attacker could potentially use this flaw to bypass the inner authentication check in FreeRADIUS by resuming an older unauthenticated TLS session...

freeradius security update

3.0.4-8 - Disable internal OpenSSL cache and fix session cache file permissions. Resolves: Bug1459131 CVE-2017-9148 freeradius: TLS resumption authentication bypass...

RHEL 7 : freeradius (RHSA-2017:1581)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1581 advisory. FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service RADIUS server, designed to allow centralized...

BSA-2017-342

Security Advisory ID : BSA-2017-342 Component : Freeradius Revision : 2.0: Interim The TLS session cache inFreeRADIUS2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remo...

[ASA-201706-2] freeradius: authentication bypass

Arch Linux Security Advisory ASA-201706-2 ========================================= Severity: High Date : 2017-06-02 CVE-ID : CVE-2017-9148 Package : freeradius Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-281 Summary ======= The package freeradius before...

FreeBSD : FreeRADIUS -- TLS resumption authentication bypass (673dce46-46d0-11e7-a539-0050569f7e80)

Stefan Winter reports : The TLS session cache in FreeRADIUS before 3.0.14 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers such as malicious 802.1X supplicants to bypass authentication via PEAP or TTLS. %NASLMINLEVEL 70300 C Tenable Network Securit...