CVE-2019-3883

In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during...

CVE-2019-3883

In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during...

CVE-2019-3883

In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during...

Information Disclosure

apache MINA is vulnerable to information disclosure. closenotify SSL/TLS messages are not handled properly and does not lead to a connection closure. This causes the server to keep the socket open, allowing the client to potentially receive clear-text messages that should have been encrypted...

[SECURITY] Fedora 30 Update: gnutls-3.6.7-1.fc30

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

openSUSE Security Update : mariadb (openSUSE-2019-427)

This update for mariadb to version 10.2.15 fixes the following issues : These security issues were fixed : - CVE-2018-2767: Enforse use of SSL/TLS in embedded server library Return of BACKRONYM bsc1088681. - CVE-2018-2786: Vulnerability in the MySQL Server component of Oracle MySQL subcomponent:...

Amazon Linux AMI : python27 / python34,python35,python36 (ALAS-2019-1169)

A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accep...

Capital One: Heartbleed Bug

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over th...

PCI & SSL/Early TLS QIDs 38601, 42366

Two QIDs will be marked as PCI Fail on May 1, 2019 as required by ASV Program Guide: QID 38601 “SSL/TLS Use of Weak RC4 Cipher” QID 42366 “SSLv3.0/TLSv1.0 Protocol Weak CBC Mode Server Side Vulnerability BEAST” Last revision of ASV Program Guide ver. 3.1 has the following for SSL/TLS component: “...

RSAC 2019: TLS Markets Flourish on the Dark Web

SAN FRANCISCO – Thriving marketplaces for TLS certificates have emerged on the Dark Web, which are hawking the certs both as individual goods and packaged with an array of malware and other ancillary services. The research, from Venafi, the University of Surrey and the Evidence-based Cybersecurit...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Personal Communications (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Personal Communications. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit...

Security Bulletin: Vulnerabilities in GSKit affect IBM Personal Communications v6.0.x (CVE-2015-0138)

Summary GSKit is an IBM component that is used by IBM Personal Communications. The GSKit that is shipped with IBM Personal Communications 6.0.13 and before contains multiple security vulnerabilities including the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability...

openSUSE Security Update : dovecot23 (openSUSE-2019-243)

This update for dovecot23 fixes the following issues : dovecot was updated to 2.3.3 release, bringing lots of bugfixes bsc1124356. Also the following security issue was fixed : - CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed bsc1123022 The...

SSL/TLS: IMAP Missing Support For STARTTLS

The remote IMAP server does not support the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SSL/TLS: POP3 Missing Support For STLS

The remote POP3 server does not support the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2019-1691

A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause the unexpected restart of the SNORT detection engine, resulting in a denial of service DoS condition. The vulnerability is due to the incomplete error handli...

Security Bulletin: IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect for Virtual Environments allow legacy SSL/TLS protocols and ciphers to be used (CVE-2018-1545)

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Client and IBM Spectrum Protect for Virtual Environments formerly Tivoli Storage Manager for Virtual Environments, allow legacy SSL/TLS protocols and ciphers to be used. This can result in the use of weaker than expected cryptograph...

SSL/TLS Certificate Common Name Mismatch

The remote server presents a SSL/TLS certificate for which the Common Name and the Subject Alternative Name don't match the server's hostname. No source data...

Security Bulletin: Vulnerability in OpenSSL affects IBM Fabric Manager (CVE-2016-2183)

Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM Fabric Manager. IBM Fabric Manager has addressed the applicable CVE. Vulnerability Details Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the...

Security Bulletin: Vulnerability in RC4 stream cipher affects MegaRAID Storage Manager (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the vulnerability. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the...