openSUSE Security Update : gnutls (openSUSE-2020-790)

This update for gnutls fixes the following issues : - CVE-2020-13777: Fixed an insecure session ticket key construction which could have made the TLS server to not bind the session ticket encryption key with a value supplied by the application until the initial key rotation, allowing an attacker ...

Security update for gnutls (important)

openSUSE Security Update: Security update for gnutls Announcement ID: openSUSE-SU-2020:0790-1 Rating: important References: 1172461 1172506 Cross-References: CVE-2020-13777 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available...

[SECURITY] [DSA 4697-1] gnutls28 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4697-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 06, 2020 https://www.debian.org/security/faq -...

Authentication flaw

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3. The earliest affected version is 3.6.4 2018-09-24 because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS...

CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3. The earliest affected version is 3.6.4 2018-09-24 because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS...

CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 is affected by a flaw in how the TLS session-ticket encryption key is constructed, caused by an 2018-09-18 commit. The earliest affected version is 3.6.4 . Until the first key rotation, the TLS server uses incorrect data in place of a key derived from the application, l...

CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3. The earliest affected version is 3.6.4 2018-09-24 because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS...

CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3. The earliest affected version is 3.6.4 2018-09-24 because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS...

Huawei EulerOS: Security Advisory for openssl111d (EulerOS-SA-2020-1613)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : openssl111d (EulerOS-SA-2020-1613)

According to the version of the openssl111d packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Server or client applications that call the SSLcheckchain function during or after a TLS 1.3 handshake may crash due to a NULL pointer...

SUSE SLES15 Security Update : nginx (SUSE-SU-2020:1171-1)

This update for nginx fixes the following issues : nginx was updated to 1.16.1 jscECO-1401 Added TLS 1.3 support jscSLE-9295, bsc1150711 Replaced obsolete GeoIP module with MaxMinDB-based GeoIP2 jscSLE-11184, bsc1156202 Started nginx after network is online bsc1155690 CVE-2019-20372: Fixed an HTT...

CVE-2020-3285

A vulnerability in the Transport Layer Security version 1.3 TLS 1.3 policy with URL category functionality for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The vulnerability i...

Design/Logic Flaw

A vulnerability in the Transport Layer Security version 1.3 TLS 1.3 policy with URL category functionality for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The vulnerability i...

CVE-2020-3285 Cisco Firepower Threat Defense Software SSL/TLS URL Category Bypass Vulnerability

A vulnerability in the Transport Layer Security version 1.3 TLS 1.3 policy with URL category functionality for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The vulnerability i...

CVE-2020-3285

Cisco Firepower Threat Defense Software TLS 1.3 URL category bypass vulnerability (CVE-2020-3285) arises from a Snort handling logic error. An unauthenticated, remote attacker could bypass the TLS 1.3 policy to access URLs that should be dropped. Affected product: FTD software with TLS policy URL...

Exploit for NULL Pointer Dereference in Openssl

CVE-2020-1967 Proof of concept exploit about OpenSSL signature...

Crash causing Denial of Service attack

Server or client applications that call the SSLcheckchain function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signaturealgorithmscert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm i...

RUSTSEC-2020-0015 Crash causing Denial of Service attack

Server or client applications that call the SSLcheckchain function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signaturealgorithmscert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm i...

GLSA-202004-10 : OpenSSL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202004-10 OpenSSL: Multiple vulnerabilities Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could perform a malicious crafted TLS...

OpenSSL 1.1.1d < 1.1.1g Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.1.1g. It is, therefore, affected by a vulnerability as referenced in the 1.1.1g advisory. - Server or client applications that call the SSLcheckchain function during or after a TLS 1.3 handshake may crash due to a NULL pointer...