CVE-2024-37309 Client initialized Session-Renegotiation DoS

CrateDB is a distributed SQL database. A high-risk vulnerability has been identified in versions prior to 5.7.2 where the TLS endpoint port 4200 permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly request renegotiation of security parameter...

OpenSSL 1.0.2 < 1.0.2zc Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.2zc. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zc advisory. - There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS...

SUSE SLED15: perl / perl-32bit / perl-base / perl-base-32bit / perl-core-DB_File / etc (SUSE-SU-2024:1762-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1762-1 advisory. Security issues fixed: - CVE-2018-6913: Fixed space calculation issues in pppack.c bsc1082216 -...

SUSE-SU-2024:1762-2 Security update for perl

This update for perl fixes the following issues: Security issues fixed: - CVE-2018-6913: Fixed space calculation issues in pppack.c bsc1082216 - CVE-2018-6798: Fixed heap buffer overflow in regexec.c bsc1082233 Non-security issue fixed: - make Net::FTP work with TLS 1.3 bsc1213638...

CVE-2024-30166

In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read of less than 256 bytes in a TLS 1.3 server via a TLS 3.1 ClientHello...

CVE-2024-28755

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtlssslsessionreset API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection,...

CVE-2024-30166

In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read of less than 256 bytes in a TLS 1.3 server via a TLS 3.1 ClientHello...

CVE-2024-28836

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server...

CVE-2024-28755

An issue in Mbed TLS 3.5.x before 3.6.0: when an SSL context is reset via mbedtls_ssl_session_reset(), the maximum TLS version to negotiate is not restored to the configured value. This can allow an attacker to prevent a server from establishing any TLS 1.3 connections, potentially causing a Deni...

CVE-2024-28755

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtlssslsessionreset API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection,...

CVE-2024-28836

CVE-2024-28836 affects Mbed TLS 3.5.x before 3.6.0. During server-side TLS version negotiation, the implementation can fall back to TLS 1.2 if TLS 1.2 is disabled. If TLS 1.2 was disabled at build time, a TLS 1.2 client could cause a denial of service by looping on a TLS 1.2 ClientHello for a TLS...

CVE-2024-30166

In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read of less than 256 bytes in a TLS 1.3 server via a TLS 3.1 ClientHello...

CVE-2024-30166

CVE-2024-30166 affects the Mbed TLS library. Affected versions: 3.3.0 through 3.5.2 prior to 3.6.0. The issue is a stack buffer over-read (less than 256 bytes) in a TLS 1.3 server when handling a TLS 3.1 ClientHello, enabling information disclosure or a denial of service. Impact (as stated): info...

CVE-2024-28836

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server...

CVE-2024-28836

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server...

CVE-2024-30166

In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read of less than 256 bytes in a TLS 1.3 server via a TLS 3.1 ClientHello...

CVE-2024-30166

In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read of less than 256 bytes in a TLS 1.3 server via a TLS 3.1 ClientHello...

BIT-ENVOY-2020-8660

CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed not recognized as a TLS client by a client using only TLS 1.3. Because TLS extensions SNI, ALPN were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some...

BIT-GOLANG-2022-41724 Panic on large handshake records in crypto/tls

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session...

CentOS 9 : containernetworking-plugins-1.3.0-2.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the containernetworking-plugins-1.3.0-2.el9 build changelog. - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a...