CVE-2021-21374

CVE-2021-21374 affects Nimble (Nim package manager) where Nimble refresh may fetch the package list over HTTPS without full SSL/TLS verification due to httpClient defaults, enabling a MitM to deliver a modified package list and installable packages. If such packages are installed, this can lead t...

CVE-2021-21374 Nimble fails to validate certificates due to insecure httpClient defaults

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

Security Bulletin: Multiple Vulnerabilities found in Axis.jar V1.x may affect IBM Content Collector for SAP Applications

Summary IBM Content Collector for SAP Applications may be affected by multiple vulnerabilities found in Axis.jar V1.x Vulnerability Details CVEID: CVE-2018-8032 DESCRIPTION: Apache Axis is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the default...

DEBIAN-CVE-2021-3446

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV initialization vector when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the calle...

UBUNTU-CVE-2021-3446

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV initialization vector when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the calle...

Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021

On March 25, 2021, the OpenSSL Project released a security advisory, OpenSSL Security Advisory 25 March 2021, "https://www.openssl.org/news/secadv/20210325.txt" that disclosed two vulnerabilities. Exploitation of these vulnerabilities could allow an attacker to use a valid non-certificate authori...

DEBIAN-CVE-2021-3450

The X509VFLAGX509STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an...

USN-4891-1: OpenSSL vulnerability

It was discovered that OpenSSL incorrectly handled certain renegotiation ClientHello messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service...

UBUNTU-CVE-2021-3449

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signaturealgorithms extension where it was present in the initial ClientHello, but includes a signaturealgorithmscert extension then a NU...

SSL/TLS: Deprecated TLSv1.0 and TLSv1.1 Protocol Detection

It was possible to detect the usage of the deprecated TLSv1.0 and/or TLSv1.1 protocol on this system. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2021-21385

CVE-2021-21385 affects Mifos-Mobile Android Application for MifosX, where the HTTP client disables hostname verification and accepts any self-signed certificate. This undermines HTTPS integrity, enabling potential man-in-the-middle attacks. The issue is mitigated by the commit e505f62 in mifos-mo...

[SECURITY] Fedora 34 Update: gnutls-3.7.1-2.fc34

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

Fedora: Security Advisory for gnutls (FEDORA-2021-18bef34f05)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : privoxy (openSUSE-2021-443)

This update for privoxy fixes the following issues : Update to version 3.0.32 : - Security/Reliability boo1183129 - ssplit: Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers Opera - cgisendbanne...

Invoke-SocksProxy - Socks Proxy, And Reverse Socks Server Using Powershell

Creates a local or "reverse" Socks proxy using powershell. The local proxy is a simple Socks 4/5 proxy. The reverse proxy creates a tcp tunnel by initiating outbond SSL connections that can go through the system's proxy. The tunnel can then be used as a socks proxy on the remote host to pivot int...

Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection

Impact Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxyconfig. Only the default SSLContext is impacted. Patches urllib3 =1.26.4 has the issue resolved. urllib31.26 is not impacted due to not supporting HTTPS requests via HTTPS proxie...

SUSE-SU-2021:0906-1 Security update for SUSE Manager Server 4.1

This update fixes the following issues: cobbler: - Fix string replacement for @@xyz@@ - Better performing string replacements grafana-formula: - Set supported to false for unsupported systems bsc1182001 - Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions mgr-libmod: - Fix 'listmodules'...

IBM DB2 9.7 < 9.7 FP11 40690 / 10.1 < 10.1 FP6 40689 / 10.5 < 10.5 FP11 40688 / 11.1 < 11.1.4 FP6 / 11.5 < 11.5.5 FP0 6195 Multiple Vulnerabilities (Unix)

According to its self-reported version number, IBM Db2 is affected by multiple vulnerabilities: - IBM Db2 for Linux, UNIX and Windows could allow an unauthenticated attacker to cause a denial of service due to a hang in the SSL handshake response. CVE-2020-5024 - IBM Db2 db2fm is vulnerable to a...

IBM DB2 9.7 < 9.7 FP11 40690 / 10.1 / 10.5 < 10.5 FP11 40688 / 11.1 < 11.1.4 FP6 / 11.5 < 11.5.5 6195 Multiple Vulnerabilities (Windows)

According to its self-reported version number, IBM Db2 is affected by multiple vulnerabilities: - IBM Db2 for Linux, UNIX and Windows could allow an unauthenticated attacker to cause a denial of service due to a hang in the SSL handshake response. CVE-2020-5024 - IBM Db2 db2fm is vulnerable to a...

Important: Red Hat Security Advisory: rubygem-em-http-request security update

An update for rubygem-em-http-request is now available for Red Hat OpenStack Platform 13 Queens. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...