CVE-2018-0739

Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so...

CVE-2018-0739

Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so...

OpenSSL -- multiple vulnerabilities

The OpenSSL project reports: Constructed ASN.1 types with a recursive definition could exceed the stack CVE-2018-0739 Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stack given malicious input with excessive recursion. This could resu...

CVE-2017-15326

DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using insecure encryption algorithms. If an insecure encryption algorithm is negotiated in the communication, an unauthenticated remote attacker...

Design/Logic Flaw

DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using insecure encryption algorithms. If an insecure encryption algorithm is negotiated in the communication, an unauthenticated remote attacker...

CVE-2017-15326

CVE-2017-15326 affects Huawei DBS3900 TDD LTE (V100R003C00, V100R004C10). The issue is a weak encryption algorithm vulnerability where SSL/TLS negotiation can select insecure ciphers, allowing an unauthenticated remote attacker to crack encrypted data and cause information leakage. Public referen...

Debian DSA-4147-1 : polarssl - security update

Several vulnerabilities were discovered in PolarSSL, a lightweight crypto and SSL/TLS library, that allowed a remote attacker to either cause a denial-of-service by application crash, or execute arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

[SECURITY] [DSA 4147-1] polarssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4147-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 21, 2018 https://www.debian.org/security/faq -...

Security Advisory - Weak Algorithm Vulnerability on Huawei Products

There is a weak encryption algorithm security vulnerability in the DBS3900 TDD LTE. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using insecure encryption algorithms. If an insecure encryption algorithm is negotiated in the communication, an unauthenticated remote attacker can exploit th...

Debian: Security Advisory (DSA-4147-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4138-1] mbedtls security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4138-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 15, 2018 https://www.debian.org/security/faq -...

Solaris 10 (x86) : 123896-77

Vulnerability in the Solaris component of Oracle Enterprise Manager Grid Control subcomponent: Common Agent Container Cacao. Supported versions that are affected are 2.3.1.0, 2.3.1.1, 2.3.1.2, 2.4.0.0, 2.4.1.0 and 2.4.2.0. Easily exploitable vulnerability allows successful authenticated network...

Solaris 10 (x86) : 123896-79

Vulnerability in the Solaris component of Oracle Enterprise Manager Grid Control subcomponent: Common Agent Container Cacao. Supported versions that are affected are 2.3.1.0, 2.3.1.1, 2.3.1.2, 2.4.0.0, 2.4.1.0 and 2.4.2.0. Easily exploitable vulnerability allows successful authenticated network...

Solaris 10 (sparc) : 150119-03

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: KSSL. Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result ...

Solaris 10 (sparc) : 123893-77

Vulnerability in the Solaris component of Oracle Enterprise Manager Grid Control subcomponent: Common Agent Container Cacao. Supported versions that are affected are 2.3.1.0, 2.3.1.1, 2.3.1.2, 2.4.0.0, 2.4.1.0 and 2.4.2.0. Easily exploitable vulnerability allows successful authenticated network...

Solaris 10 (sparc) : 123893-79

Vulnerability in the Solaris component of Oracle Enterprise Manager Grid Control subcomponent: Common Agent Container Cacao. Supported versions that are affected are 2.3.1.0, 2.3.1.1, 2.3.1.2, 2.4.0.0, 2.4.1.0 and 2.4.2.0. Easily exploitable vulnerability allows successful authenticated network...

Solaris 10 (x86) : 150120-03

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: KSSL. Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability can result ...

[SECURITY] Fedora 27 Update: mbedtls-2.7.0-1.fc27

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

[SECURITY] Fedora 26 Update: mbedtls-2.7.0-1.fc26

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

Free and Open Source Interactive HTTPS Proxy: mitmproxy

mitmproxy is your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, WebSockets, or any other SSL/TLS-protected protocols. You can prettify and decode a variety of...