Security Bulletin: FREAK vulnerability in TLS/SSL affects IBM CICS Transaction Gateway (CVE-2015-0204)

Summary A vulnerability in the OpenSSL ssl3getkeyexchange function could allow a remote downgrade the security of certain TLS connections. An OpenSSL client accepts the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using a...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Remote server (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of WebSphere Remote Server. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details For vulnerability details, see the IBM DB2 is impacted by multiple TLS/SSL security vulnerabilities...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM Business Monitor (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM Business Monitor. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details For vulnerability details, see the IBM DB2 is impacted by multiple TLS/SSL security vulnerabilities...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Enterprise Service Bus (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of WebSphere Enterprise Service Bus. Information about security vulnerabilities that affect IBM DB2 have been published in a security bulletin Vulnerability Details Consult the security bulletin IBM DB2 is impacted by multiple TLS/SSL security...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Enterprise Service Bus Registry Edition (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of WebSphere Enterprise Service Bus Registry Edition. Information about security vulnerabilities that affect IBM DB2 have been published in a security bulletin Vulnerability Details Consult the security bulletin IBM DB2 is impacted by multiple TLS/SSL...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Dynamic Process Edition (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of WebSphere Dynamic Process Edition. Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin. Vulnerability Details Consult the IBM DB2 is impacted by multiple TLS/SSL security vulnerabilities security...

Internet Bug Bounty: Silent omission of certificate hostname verification in LibreSSL and BoringSSL

Abstract LibreSSL and BoringSSL implemented X509VERIFYPARAMset1host differently than OpenSSL. All applications that use the preferred and documented way to configure a TLS connection for hostname validation, silently neglect to perform hostname validation at all. As a consequence, they are...

Security feature bypass

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

CVE-2017-9968

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

CVE-2017-9968

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

Code injection

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail...

CVE-2016-8610

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail...

CVE-2016-8610

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail...

CVE-2016-8610

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail...

CVE-2016-8610

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services security update

An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link...

Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012 (KB 4040979)

Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012 KB 4040979 Notice This update is included in the Security and Quality Rollup that's dated November 14, 2017. This update was previously released as part of the Preview of Quality Rollup on October 17, 2017, the Security an...

EulerOS 2.0 SP2 : python (EulerOS-SA-2017-1186)

According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The Python standard library HTTP client modules such as httplib or urllib did not perform verification of TLS/SSL certificates when connecting to...

EulerOS 2.0 SP1 : python (EulerOS-SA-2017-1185)

According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The Python standard library HTTP client modules such as httplib or urllib did not perform verification of TLS/SSL certificates when connecting to...

CentOS 7 : python (CESA-2017:1868)

An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...