Security Bulletin: Vulnerabilities in OpenSSL affect System x Integrated Management Module (IMM) (CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by System x Integrated Management Module IMM. IMM hasaddressed the applicable CVEs...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System Networking Switches (CVE-2014-3570, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by IBM Flex System Networking Switches. The IBM Flex System Networking Switches listed belo...

Information Leakage

The GnuTLS library is susceptible to information leakage. When CBC-mode cipher is used, attacker can use a TLS/SSL server as a padding oracle to decrypt the encrypted packets...

Information Leakage

OpenSSL is vulnerable to information leakage. When optional compression is used, TLS/SSL protocol does not obscure the length of the unencrypted data. Using this flaw, an attacker can perform brute force attack to guess encrypted TLS/SSL connection...

EulerOS Virtualization 2.5.1 : openssl098e (EulerOS-SA-2018-1379)

According to the version of the openssl098e package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection...

testssl.sh - Testing TLS/SSL Encryption Anywhere On Any Port

testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as some cryptographic flaws. Key features Clear output: you can tell easily whether anything is good or bad Ease of installation: It works for Linux, OSX/Darwin...

Security Bulletin: Vulnerabilities in IBM Java runtime affect ClearQuest Eclipse (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM® Runtime Environment Java™ Technology Edition that is used by ClearQuest Eclipse client. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in various IBM SSL/TLS...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM InfoSphere Guardium Data Redaction (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM® SDK Java™ Technology Edition, Version 6 that is used by IBM InfoSphere Guardium Data Redaction. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in various IBM...

CentOS 7 : python (CESA-2018:2123)

An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

python, tkinter security update

CentOS Errata and Security Advisory CESA-2018:2123 An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

openssl: Truncated packet could crash via OOB read

An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite...

Security Bulletin: Vulnerabilities in OpenSSL affect Rational ClearCase (CVE-2014-3570, CVE-2014-3572, CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by Rational ClearCase. Rational ClearCase has addressed the applicable CVEs. Vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Rational ClearCase (CVE-2015-0138, CVE-2014-6593, CVE-2015-0383, CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 5 and 6 that are used by IBM Rational ClearCase. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK: Factoring Attack on...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Rational ClearCase (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM WebSphere Application Server Versions 6.1, 7, 8, 8.5, and 8.5.5 that are used by IBM Rational ClearCase. Vulnerability Details Please consult the Security Bulletin: Vulnerability with RSA...

Scientific Linux Security Update : python on SL7.x x86_64 (20180703)

Security Fixes : - A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used ...

Moderate: Red Hat Security Advisory: python security update

An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Code injection

Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server...

CVE-2018-1249

Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server...

CVE-2018-1249 iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs

Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server...

Security Bulletin: Vulnerabilities in Mozilla NSS affect the IBM FlashSystem model V840

Summary There are vulnerabilities in Mozilla Network Security Services NSS to which the IBM® FlashSystem™ V840 is susceptible. An exploit of these vulnerabilities CVE-2016-2834, CVE-2016-5285, and CVE-2016-8635 could allow a remote attacker to execute arbitrary code, to recover private keys, to...