USN-7330-1: Ansible vulnerabilities

It was discovered that Ansible did not properly verify certain fields of X.509 certificates. An attacker could possibly use this issue to spoof SSL servers if they were able to intercept network communications. This issue only affected Ubuntu 14.04 LTS. CVE-2015-3908 Martin Carpenter discovered...

Linux Distros Unpatched Vulnerability : CVE-2024-0397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A defect was discovered in the Python ssl module where there is a memory race condition with the ssl.SSLContext methods certstorestats and getcacerts. The race...

Linux Distros Unpatched Vulnerability : CVE-2024-47750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix Use-After-Free of rsvqp on HIP08 Currently rsvqp is freed before...

Linux Distros Unpatched Vulnerability : CVE-2022-45197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp. CVE-2022-45197...

Linux Distros Unpatched Vulnerability : CVE-2012-6709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation. CVE-2012-6709 Note that Nessus relies on the presence of the package as reported by...

Linux Distros Unpatched Vulnerability : CVE-2012-0867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, whic...

Linux Distros Unpatched Vulnerability : CVE-2014-3230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server...

Linux Distros Unpatched Vulnerability : CVE-2012-5662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509...

Linux Distros Unpatched Vulnerability : CVE-2013-7449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The ssldoconnect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in...

Linux Distros Unpatched Vulnerability : CVE-2015-5262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an S...

Linux Distros Unpatched Vulnerability : CVE-2017-1000256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libvirt version 2.3.0 and later is vulnerable to a bad default configuration of verify-peer=no passed to QEMU by libvirt resulting in a failure to validate...

Linux Distros Unpatched Vulnerability : CVE-2014-9365

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP clients in the 1 httplib, 2 urllib, 3 urllib2, and 4 xmlrpclib libraries in CPython aka Python 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an...

Linux Distros Unpatched Vulnerability : CVE-2017-10789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The DBD::mysql module through 4.043 for Perl uses the mysqlssl=1 setting to mean that SSL is optional even though this setting's documentation has a your...

Linux Distros Unpatched Vulnerability : CVE-2014-3596

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or...

Linux Distros Unpatched Vulnerability : CVE-2013-0743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA at the suggestion of the CVE project team...

Linux Distros Unpatched Vulnerability : CVE-2012-2132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass...

Linux Distros Unpatched Vulnerability : CVE-2014-3577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the...

Linux Distros Unpatched Vulnerability : CVE-2012-6153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the...

Linux Distros Unpatched Vulnerability : CVE-2015-0564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer underflow in the ssldecryptrecord function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remot...

Linux Distros Unpatched Vulnerability : CVE-2015-1777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rhnregks in Red Hat Network Client Tools aka rhn-client-tools on Red Hat Gluster Storage 2.1 and Enterprise Linux RHEL 5, 6, and 7 does not properly validate...