Moderate: Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

An update for nss and nspr is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

CVE-2019-11727

A vulnerability exists where it possible to force Network Security Services NSS to sign CertificateVerify with PKCS1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerabilit...

CVE-2019-11727

A vulnerability exists where it possible to force Network Security Services NSS to sign CertificateVerify with PKCS1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerabilit...

Design/Logic Flaw

A vulnerability exists where it possible to force Network Security Services NSS to sign CertificateVerify with PKCS1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerabilit...

CVE-2019-11727

CVE-2019-11727 concerns Mozilla NSS and affects Firefox versions earlier than 68. The issue allows NSS to sign TLS 1.3 CertificateVerify messages with PKCS#1 v1.5 signatures when those are the only ones advertised by the server in CertificateRequest. This is inappropriate for TLS 1.3 and is the u...

CVE-2019-11727

A vulnerability exists where it possible to force Network Security Services NSS to sign CertificateVerify with PKCS1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerabilit...

CVE-2019-11727

A vulnerability exists where it possible to force Network Security Services NSS to sign CertificateVerify with PKCS1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerabilit...

CVE-2019-11727

A vulnerability exists where it possible to force Network Security Services NSS to sign CertificateVerify with PKCS1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerabilit...

CVE-2019-11727

A vulnerability exists where it possible to force Network Security Services NSS to sign CertificateVerify with PKCS1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerabilit...

EulerOS 2.0 SP8 : gnutls (EulerOS-SA-2019-1649)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way gnutls handled malformed TLS 1.3 asynchronous messages. An attacker could use this flaw to crash an application...

Qt 5.12.4 Released with support for OpenSSL 1.1.1

Qt 5.12.4, the fourth patch release of Qt 5.12 LTS, is released today. Qt 5.12.4 release provides a number of bug fixes, as well as performance and other improvements. As an important new item it provides binaries build with OpenSSL 1.1.1, including the new TLS 1.3 functionality. Compared to Qt...

openSUSE Security Update : gnutls (openSUSE-2019-1353)

This update for gnutls fixes to version 3.6.7 the following issues : Security issued fixed : - CVE-2019-3836: Fixed an invalid pointer access via malformed TLS1.3 async messages bsc1130682. - CVE-2019-3829: Fixed a double free vulnerability in the certificate verification API bsc1130681. -...

Security update for gnutls (important)

openSUSE Security Update: Security update for gnutls Announcement ID: openSUSE-SU-2019:1353-1 Rating: important References: 1118087 1130681 1130682 Cross-References: CVE-2018-16868 CVE-2019-3829 CVE-2019-3836 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilities is now...

SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2019:1121-1)

This update for gnutls fixes to version 3.6.7 the following issues : Security issued fixed : CVE-2019-3836: Fixed an invalid pointer access via malformed TLS1.3 async messages bsc1130682. CVE-2019-3829: Fixed a double free vulnerability in the certificate verification API bsc1130681...

SUSE-SU-2019:1121-1 Security update for gnutls

This update for gnutls fixes to version 3.6.7 the following issues: Security issued fixed: - CVE-2019-3836: Fixed an invalid pointer access via malformed TLS1.3 async messages bsc1130682. - CVE-2019-3829: Fixed a double free vulnerability in the certificate verification API bsc1130681. -...

CVE-2019-3836

A flaw was found in the way gnutls handled malformed TLS 1.3 asynchronous messages. An attacker could use this flaw to crash an application compiled with gnutls via invalid pointer access...

openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2019-442)

This update for MozillaFirefox, mozilla-nss fixes the following issues : Security issue fixed in Mozilla Firefox 60.0.2 ESR : - CVE-2018-6126: Heap buffer overflow rasterizing paths in SVG with Skia MFSA 2018-14, boo1096449 The following bugs were fixed : - In KDE Open with option in download...

New Settings Let Hackers Easily Pentest Facebook, Instagram Mobile Apps

Facebook has introduced a new feature in its platform that has been designed to make it easier for bug bounty hunters to find security flaws in Facebook, Messenger, and Instagram Android applications. Since almost all Facebook-owned apps by default use security mechanisms such as Certificate...

March Release: Q&A with Ari Weil

Shortly after Akamai announced the March 2019 Release with new features and capabilities across its security, performance and media product lines, Akamai's VP of Product Marketing, Ari Weil, took over Akamai's Twitter account for a live March Release Q&A. For those that missed the live event,...

Critical DoS Bug Bubbles Up in Facebook Fizz TLS 1.3 Project

A critical denial-of-service DoS vulnerability in Facebook’s open-source implementation of the transport layer security TLS 1.3 protocol could cause an infinite loop – thus disrupting any web service that relies on it. Kevin Backhouse, a researcher at Semmle, discovered the bug in the project...