CVE-2021-22897

CVE-2021-22897 affects curl/libcurl when built with Schannel TLS. A bug stores the CURLOP SSL_CIPHER_LIST selection in a single static variable, causing the last cipher set to apply to all concurrent transfers. This can lead to exposure of data to the wrong session and weaker transport security. ...

A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.

...

a2 (>=0.5.0-alpha.6, <=0.5.0-alpha.7), azure_sdk_auth_aad (>=0.30.0, <=0.35.0) +19 more potentially affected by CVE-2020-35875 via tokio-rustls (>=0.12.0-alpha.1, <=0.12.0-alpha.8)

tokio-rustls CARGO version =0.12.0-alpha.1, =0.5.0-alpha.6, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.1.0-alpha.1, =0.1.0, =0.30.0, =3.2.2, =3.4.2 and more Source cves: CVE-2020-35875 Source advisory: OSV:RUSTSEC-2020-0019...

CVE-2019-13163

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

Design/Logic Flaw

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

CVE-2019-13163

The CVE-2019-13163 entry describes a vulnerability in the Fujitsu TLS library that enables a man-in-the-middle attack affecting a range of Fujitsu products (e.g., Interstage components, Systemwalker suite, and related servers/workloads). The underlying issue is in the TLS library’s handling of cr...

CVE-2019-13163

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

USN-4233-1: GnuTLS update

As a security improvement, this update marks SHA1 as being untrusted for digital signature operations...

Debian DSA-4296-1 : mbedtls - security update

Two vulnerabilities were discovered in mbedtls, a lightweight crypto and SSL/TLS library which could result in plain text recovery via side-channel attacks. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-429...

Debian DSA-4147-1 : polarssl - security update

Several vulnerabilities were discovered in PolarSSL, a lightweight crypto and SSL/TLS library, that allowed a remote attacker to either cause a denial-of-service by application crash, or execute arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Debian: Security Advisory (DSA-4147-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

axTLS Encoding Error Vulnerability

axTLS is a highly configurable client/server TLS Secure Transport Layer Protocol library. axTLS is an ASN.1 Abstract Syntax Markup parser. A security vulnerability exists in the ASN.1 parser in axTLS version 1.5.3. An attacker could exploit this vulnerability to cause a device to interpret the ye...

USN-2913-4: GnuTLS update

USN-2913-1 removed 1024-bit RSA CA certificates from the ca-certificates package. This update adds support for alternate certificate chains to the GnuTLS package to properly handle the removal. Original advisory details: The ca-certificates package contained outdated CA certificates. This update...

USN-2865-1: GnuTLS vulnerability

Karthikeyan Bhargavan and Gaetan Leurent discovered that GnuTLS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...

UBUNTU-CVE-2015-8313

GnuTLS incorrectly validates the first byte of padding in CBC modes...

Debian DSA-2981-1 : polarssl - security update

A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS library, which can be exploited by a remote unauthenticated attacker to mount a denial of service against PolarSSL servers that offer GCM ciphersuites. Potentially clients are affected too if a malicious server decides to execute...

USN-2229-1 gnutls26 vulnerability

Joonas Kuorilehto discovered that GnuTLS incorrectly handled Server Hello messages. A malicious remote server or a machine-in-the-middle could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-2121-1: GnuTLS vulnerability

Suman Jana discovered that GnuTLS incorrectly handled version 1 intermediate certificates. This resulted in them being considered to be a valid CA certificate by default, which was contrary to documented behaviour...

Microsoft Windows multiple security vulnerabilities

Print spooler service code execution, XML library integer overflow and memory corruption, multiple .Net vulnerabilities, Win32K privilege escalation SSL/TLS library protection bypass, Open Data Protocol DoS...

GnuTLS insufficient cert verification

libcurl when built to use GnuTLS fails to verify that a peer's certificate has not already expired or has not yet become valid. This allows malicious servers to present certificates to libcurl that were not rejected properly. Notably, the CA certificate and common name checks are still in place...