CVE-2021-43767

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's...

CVE-2021-43766

Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate...

CVE-2021-43766

Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate...

CVE-2021-43767

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's...

Sql injection

Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate...

Authentication flaw

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's...

CVE-2021-43767

Technical details about CVE-2021-43767 are not publicly available in the provided connected documents. Please monitor for updates.

CVE-2021-43767

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's...

CVE-2021-43766

CVE-2021-43766 describes an issue where, when Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle can inject arbitrary SQL queries on the initial connection, despite SSL certificate verification and encryption. The risk is evidenced by the relation ...

CVE-2021-43766

Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate...

SUSE-SU-2022:2893-1 Security update for postgresql10

This update for postgresql10 fixes the following issues: - Upgrade to 10.22: - CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension bsc1202368. - Upgrade to 10.21: - CVE-2022-1552: Confined additional operations within 'security restricted...

Security update for nim (important)

openSUSE Security Update: Security update for nim Announcement ID: openSUSE-SU-2022:10095-1 Rating: important References: 1175332 1175333 1175334 1181705 1185083 1185084 1185085 1185948 1192712 Cross-References: CVE-2020-15690 CVE-2020-15692 CVE-2020-15693 CVE-2020-15694 CVE-2021-21372...

Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with IBM System Networking Element Manager (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM System Networking Element Manager. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM® DB2® is impacted by multiple TLS/SSL security...

Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family (CVE-2011-3389)

Summary SSL and TLS vulnerabilities were disclosed in September 2011. This vulnerability has been referred to as the “BEAST” attack. SSL protocol is used by SAN Volume Controller and Storwize Family. Vulnerability Details CVE-ID : CVE-2011-3389 DESCRIPTION : Multiple products could allow a remote...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Cisco Switches and Directors.

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Cisco Switches and Directors. IBM Cisco Switches and Directors has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denia...

Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with Tivoli Storage Productivity Center and System Storage Productivity Center (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of Tivoli Storage Productivity Center and System Storage Productivity Center. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM DB2 is...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool, IBM Tivoli Asset Discovery for Distributed and IBM Endpoint Manager for Software Use Analysis (April 2015 CPU)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed.These issues were disclosed as part of the IBM Java SDK updates in April 2015. This bulletin also addresses FREAK: Factoring Attack ...

Security Bulletin: Vulnerability in IBM WebSphere Application Server affects WebSphere Business Services Fabric (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM WebSphere Application Server Full Profile that is used by WebSphere Business Services Fabric. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in various IBM SSL/TLS...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM License Metric Tool v7.5 and v7.2.2, IBM Endpoint Manager for Software Use Analysis v2.2 and IBM Tivoli Asset Discovery for Distributed v7.5 and v7.2.2 - CVE-2015-2808

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM License Metric Tool v7.5 and v7.2.2, IBM Endpoint Manager for Software Use Analysis v2.2 and IBM Tivoli Asset Discovery for Distributed v7.5 and v7.2.2 Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used i...

Security Bulletin: TSM FastBack GSKit Certificate Chaining Vulnerability (CVE-2013-6747)

Summary A vulnerability has been identified in the IBM Global Security Kit GSKit component utilized by IBM Tivoli Storage Manager TSM FastBack. A malformed certificate chain can cause the TSM FastBack process using GSKit to hang or crash. FastBack 6.1.9.1 or higher contains the fixing GSKit level...