openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...

Sandbox Restrictions Bypass

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to...

EulerOS Virtualization 2.5.4 : openssl (EulerOS-SA-2019-1201)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigat...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments: Data Protection for VMware (CVE-2018-0737, CVE-2018-0732)

Summary OpenSSL vulnerabilities were disclosed on April 16, 2018 and June 16, 2018 by the OpenSSL Project. OpenSSL, used by the IBM Spectrum Protect formerly Tivoli Storage Manager Backup-Archive Client and IBM Spectrum Protect for Virtual Environments formerly Tivoli Storage Manager for Virtual...

Palo Alto Networks PAN-OS 6.1.x <= 6.1.20 / 7.1.x < 7.1.21 / 8.0.x < 8.0.14 / 8.1.x < 8.1.4 Multiple Vulnerabilities (PAN-SA-2018-0015)

The version of Palo Alto Networks PAN-OS running on the remote host is 6.1.x including 6.1.20 or 7.1.x prior to 7.1.21 or 8.0.x prior to 8.0.14 or 8.1.x prior to 8.1.4. It is, therefore, affected by multiple vulnerabilities : - A denial of service DoS vulnerability that exists in OpenSSL due to...

openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-549)

This update for openssl-100 fixes the following issues : - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating...

openSUSE Security Update : openssl-1_1 (openSUSE-2019-751)

This update for openssl-11 to 1.1.0i fixes the following issues : These security issues were fixed : - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an...

openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-753)

This update for openssl-100 to 1.0.2p fixes the following issues : These security issues were fixed : - Prevent One&Done side-channel attack on RSA that allowed physically near attackers to use EM emanations to recover information bsc1104789 - CVE-2018-0737: The RSA Key generation algorithm has...

openSUSE Security Update : openssl-1_1 (openSUSE-2019-550)

This update for openssl-11 fixes the following issues : - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating ...

Security Bulletin: IBM Flex System Manager (FSM) and compatible IBM Systems Director agents are affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450, and CVE-2013-6449)

Summary An interface on the IBM BladeCenter Advanced Management Module AMM may expose user account names and passwords that have been configured on that AMM. Vulnerability Details Abstract The FSM and compatible agents contain a version of openssl that contained the 3 vulnerabilities listed above...

CVE-2018-15784

Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server's certificate authority during TLS handshake. Use of an invalid or malicious certificate could potentially allow an attacker to spoof a trusted entity by...

CVE-2018-15784

Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature where the TLS handshake does not properly validate the server certificate authority. This misvalidation could allow an attacker to perform a MITM attack by presenting an invalid or malicious certific...

Denial Of Service (DoS)

tigervnc is vulnerable to denial of service DoS attacks. The vulnerability exists as the Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...

Man-in-the-Middle (MitM)

nss is vulnerable to man-in-the-middle attack. A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could...

Denial Of Service (DoS) Through Null Pointer Dereference

OpenSSL is vulnerable to denial of service DoS attacks. These attacks are possible because attackers can trigger a null pointer dereference through a Next Protocol Negotiation record in a TLS handshake...

Junos OS: OpenSSL Security Advisories [16 Apr 2018] and [12 June 2018] (JSA10919)

According to its self-reported version number, the remote Juniper Junos device is affected by a multiple vulnerabilities: - During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend...

EulerOS 2.0 SP5 : openssl (EulerOS-SA-2019-1009)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 - openssl: Malicious server can send large prime to...

Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2018-0732)

Summary IBM MQ Appliance has addressed the following denial of service vulnerability. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server during key agreement in...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2018:2036-1)

This update for openssl-11 fixes the following issues : - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating ...

Tenable Nessus < 7.1.4 Multiple Vulnerabilities (TNS-2018-17)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 7.1.4. It is, therefore, affected by multiple vulnerabilities: - Tenable Nessus contains a flaw in the bundled third-party component OpenSSL library's key handling during a TLS handshake...