Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

Impact When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing CPU resources to eventually reach 100% usage. Workarounds The problem can be worked around by compiling the...

CVE-2021-28196

The specific function in ASUS BMC’s firmware Web management page Generate SSL certificate function does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the...

Buffer overflow

The specific function in ASUS BMC’s firmware Web management page Generate SSL certificate function does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the...

Buffer overflow

The specific function in ASUS BMC’s firmware Web management page Generate new SSL certificate does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web...

CVE-2021-28196

The CVE-2021-28196 issue affects ASUS BMC firmware Web management (Generate SSL certificate function). The root cause is failure to validate user-entered string length, leading to a buffer overflow. This could allow remote attackers with privileged access to terminate the Web service via leakage ...

CVE-2021-28196 ASUS BMC's firmware: buffer overflow - Generate SSL certificate function

The specific function in ASUS BMC’s firmware Web management page Generate SSL certificate function does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the...

CVE-2021-28187 ASUS BMC's firmware: buffer overflow - Generate new SSL certificate

The specific function in ASUS BMC’s firmware Web management page Generate new SSL certificate does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web...

CVE-2021-28187

The CVE-2021-28187 entry concerns ASUS BMC firmware’s Web management page, specifically the Generate new SSL certificate function. The root cause is failure to validate the length of user-entered strings, leading to a Buffer Overflow. Reported impact states that a remote attacker could use this l...

Fedora: Security Advisory for curl (FEDORA-2021-065371f385)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 33 Update: curl-7.71.1-9.fc33

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

VulnCheck KEV: CVE-2020-12812

Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication FortiToken if they change the case in their username...

Cisco Adaptive Security Appliance Software SSL/TLS DoS (cisco-sa-asa-ssl-dos-7uZWwSEy)

A denial of service DoS vulnerability exists in Cisco Adaptive Security Appliance due to improper error handling on established SSL/TLS connections. An unauthenticated, remote attacker can exploit this issue, by establishing an SSL/TLS connection with the affected device and then sending a...

CVE-2021-28165

When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing high CPU resources utilization. The highest threat from this vulnerability is to service availability...

CVE-2021-28363

A flaw was found in python-urllib3. SSL certificate validation is omitted in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates for different...

Hackers are implanting multiple backdoors at industrial targets in Japan

Cybersecurity researchers on Tuesday disclosed details of a sophisticated campaign that deploys malicious backdoors for the purpose of exfiltrating information from a number of industry sectors located in Japan. Dubbed "A41APT" by Kaspersky researchers, the findings delve into a new slew of attac...

RLSA-2021:1024 Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: NULL pointer dereference in signaturealgorithms processing CVE-2021-3449 openssl: CA certificate...

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

Remote code execution

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...