84 matches found
CVE-2024-1300 Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading...
CVE-2024-1300 Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading...
CVE-2024-1300
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading...
PT-2024-7970
Name of the Vulnerable Software and Affected Versions Eclipse Vert.x affected versions not specified Description A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name, the default certifica...
GHSA-5F35-PQ34-C87Q Apache Airflow missing Certificate Validation
Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepte...
SUSE CVE-2019-11324
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...
CVE-2022-23000
The Western Digital My Cloud Web App https://os5.mycloud.com/ uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation,...
SUSE: Security Advisory (SUSE-SU-2016:1366-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2021-17850
Name of the Vulnerable Software and Affected Versions: urllib3 versions 1.26.x through 1.26.3 Description: The issue concerns the omission of SSL certificate validation in certain cases involving HTTPS to HTTPS proxies. Specifically, when an SSLContext is not provided via proxy config, the initia...
freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BNCTX instance to handle all handshakes. This mean multiple threads use the same BNCTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a...
python-urllib3: Certification mishandle when error should be thrown
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...
python-urllib3: Certification mishandle when error should be thrown
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...
PYSEC-2019-63
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...
PYSEC-2019-133
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...
PYSEC-2019-133
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...
PT-2019-20150
Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.24.2 Description The issue arises from the mishandling of certain cases where the desired set of CA certificates differs from the OS store of CA certificates. This results in SSL connections succeeding when they...
openSUSE Security Update : haproxy (openSUSE-2019-824)
This update for haproxy to version 1.8.14 fixes the following issues : These security issues were fixed : - CVE-2018-14645: A flaw was discovered in the HPACK decoder what caused an out-of-bounds read in hpackvalididx that resulted in a remote crash and denial of service bsc1108683 -...
Fedora 28 : mosquitto (2019-8cbe2a05cd)
Fixes for the following CVES : - CVE-2018-12546 - CVE-2018-12550 - CVE-2018-12551 The list of other fixes addressed in version 1.5.6 is: Broker : - Fixed comment handling for config options that have optional arguments. - Improved documentation around bridge topic remapping. - Handle mismatched...
HP Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (Metasploit)
Exploit Title: Data Protector Encrypted Communications Date: 26-05-2016 Exploit Author: Ian Lovering Vendor Homepage: http://www8.hp.com/uk/en/software-solutions/data-protector-backup-recovery-software/ Version: A.09.00 and earlier Tested on: Windows Server 2008 CVE : CVE-2016-2004 This module...
SUSE SLES11 Security Update : SUSE Manager Client Tools (SUSE-SU-2016:1366-1)
This update for SUSE Manager Client Tools provides the following fixes and enhancements : rhnlib : - Use TLSv1METHOD in SSL Context bsc970989 suseRegisterInfo : - Fix file permissions bsc970550 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...