Palo Alto Networks PAN-OS 8.1.x / 9.0.x / 9.1.x / 10.0.x Improper Input Validation

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x or 9.0.x or 9.1.x or 10.0.x. It is, therefore, affected by a improper input validation vulnerability. - When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL...

The SNI Feature of NetScaler Appliance

This article contains information about Server Name Identification SNI feature of the NetScaler appliance. Background The SNI feature is included starting with the NetScaler software release 9.2. Note : The SNI feature is not supported on the back end connections. For information on how to...

OPENSUSE-SU-2020:1505-1 Security update for libetpan

This update for libetpan fixes the following issues: Update to 1.9.4 boo1174579, CVE-2020-15953: Bugfixes on QUOTA Varios warning fixes & build fixes Update to version 1.9.3 Added IMAP CLIENTID / SMTP CLIENTID support Use Cyrus SASL 2.1.27 Update to version 1.9.2 Support of TLS SNI LMDB for cache...

openSUSE Security Update : libetpan (openSUSE-2020-1454)

This update for libetpan fixes the following issues : Update to 1.9.4 boo1174579, CVE-2020-15953 : - Bugfixes on QUOTA - Varios warning fixes & build fixes Update to version 1.9.3 - Added IMAP CLIENTID / SMTP CLIENTID support - Use Cyrus SASL 2.1.27 Update to version 1.9.2 - Support of TLS SNI -...

OPENSUSE-SU-2020:1454-1 Security update for libetpan

This update for libetpan fixes the following issues: Update to 1.9.4 boo1174579, CVE-2020-15953: Bugfixes on QUOTA Varios warning fixes & build fixes Update to version 1.9.3 Added IMAP CLIENTID / SMTP CLIENTID support Use Cyrus SASL 2.1.27 Update to version 1.9.2 Support of TLS SNI LMDB for cache...

Security update for libetpan (moderate)

openSUSE Security Update: Security update for libetpan Announcement ID: openSUSE-SU-2020:1454-1 Rating: moderate References: 1174579 Cross-References: CVE-2020-15953 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for libetpa...

CVE-2020-2035

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

Design/Logic Flaw

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

CVE-2020-2035 PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

CVE-2020-2035

CVE-2020-2035 (PAN-OS) affects PAN-OS when SSL/TLS Forward Proxy Decryption is enabled. The URL filtering policy inspects HTTP Host/URL path but ignores the TLS Client Hello SNI, allowing a compromised host to evade policies on decrypted HTTPS traffic. Impact is described as low for integrity; no...

PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

PT-2020-15260

Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 10.1 Description The PAN-OS URL filtering feature does not consider the Server Name Indication SNI field within the TLS Client Hello handshake when SSL/TLS Forward Proxy Decryption mode is enabled. This allows a...

CVE-2020-2035: Improper Input Validation

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

PT-2020-6610

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 6.4.4 FortiOS versions prior to 6.2.6 FortiOS versions prior to 6.0.12 FortiOS versions prior to 5.6.14 FortiGate versions 6.4.3 and below FortiGate versions 6.2.5 and below FortiGate versions 6.0.11 and below FortiGa...

CVE-2020-11767

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

DTLS 1.0 or DTLS 1.2 is not working through Citrix Access Gateway Vserver with SNI based certificate

On the Citrix Director or on the VDA server, you will we see that the ICA communication happened over TCP rather than UDP. Issue is seen through Citrix Firmware versions 13.0 47.24 or 13.0 build 52.24. If you have Certificate X which was bound to Citrix Access Gateway VServer as SNI Certificate,...

CVE-2020-11767

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

CVE-2020-11767

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

Design/Logic Flaw

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

CVE-2020-11767

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...