CVE-2022-26491

An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attack...

Huawei EulerOS: Security Advisory for libzapojit (EulerOS-SA-2022-1743)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Lack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin

Amazon EC2 Plugin connects to Windows agents via HTTPS. Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed HTTPS certificates and does not perform hostname validation when connecting to Windows agents. This lack of validation could be abused using a man-in-the-middle attack ...

GHSA-35J2-P8FH-X966 Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the servercacert setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the...

GHSA-XMQV-PFW7-QMJ7 Jenkins ElectricFlow Plugin globally and unconditionally disabled SSL/TLS certificate validation

CloudBees CD Plugin unconditionally disabled SSL/TLS certificate validation for the entire Jenkins controller JVM during the deployment/publication of an application. CloudBees CD Plugin no longer does that. Instead, the existing opt-in option to ignore SSL/TLS errors is used during deployment fo...

Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the servercacert setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the...

Oracle Linux 8 : gfbgraph (ELSA-2022-1801)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-1801 advisory. 0.2.4-1 - Update to 0.2.4 Resolves: 1997941 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

SUSE SLED15: finch / finch-devel / libpurple / libpurple-branding-upstream / etc (SUSE-SU-2022:1693-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1693-1 advisory. - CVE-2022-26491: Fixed MITM vulnerability when DNSSEC wasn't used bsc1199025. Tenable has extracted the preceding...

Urllib3 Incorrect Certificate Validation

Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. Thi...

cockpit security, bug fix, and enhancement update

264.1-1.0.1 - Remove duplicate reference to server in cockpit Orabug: 33862832 - Update documentation links Orabug: 32795691 - Make documentation links point to Oracle Linux information Orabug: 30271413 Orabug: 32013095 - Fix rendering of hwinfo page on systems with some empty memory slots Orabug...

SUSE SLED12: finch / finch-devel / libpurple / libpurple-branding-upstream / etc (SUSE-SU-2022:1664-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1664-1 advisory. - CVE-2022-26491: Fixed MITM vulnerability when DNSSEC wasn't used bsc1199025. Tenable has extracted the preceding...

CURL-CVE-2022-27781 CERTINFO never-ending busy-loop

libcurl provides the CURLOPTCERTINFO option to allow applications to request details to be returned about a TLS server's certificate chain. Due to an erroneous function, a malicious server could make libcurl built with NSS get stuck in a never-ending busy-loop when trying to retrieve that...

RHEL 8 : gfbgraph (RHSA-2022:1801)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:1801 advisory. GLib/GObject wrapper for the Facebook Graph API that integrates with GNOME Online Accounts. The following packages have been upgraded to a later...

Akka HTTP 10.1.14 - Denial of Service Exploit

Exploit Title: Akka HTTP Denial of Service via Nested Header Comments Exploit Author: cxosmo Vendor Homepage: https://akka.io Software Link: https://github.com/akka/akka-http Version: Akka HTTP 10.1.x 10.1.15 & 10.2.x 10.2.7 Tested on: Akka HTTP 10.2.4, Ubuntu CVE : CVE-2021-42697 import argparse...

ALSA-2022:1801 Moderate: gfbgraph security update

GLib/GObject wrapper for the Facebook Graph API that integrates with GNOME Online Accounts. The following packages have been upgraded to a later upstream version: gfbgraph 0.2.4. BZ1997941 Security Fixes: gfbgraph: missing TLS certificate verification CVE-2021-39358 For more details about the...

RLSA-2022:1801 Moderate: gfbgraph security update

GLib/GObject wrapper for the Facebook Graph API that integrates with GNOME Online Accounts. The following packages have been upgraded to a later upstream version: gfbgraph 0.2.4. BZ1997941 Security Fixes: gfbgraph: missing TLS certificate verification CVE-2021-39358 For more details about the...

Moderate: gfbgraph security update

GLib/GObject wrapper for the Facebook Graph API that integrates with GNOME Online Accounts. The following packages have been upgraded to a later upstream version: gfbgraph 0.2.4. BZ1997941 Security Fixes: gfbgraph: missing TLS certificate verification CVE-2021-39358 For more details about the...

gfbgraph security update

An update is available for gfbgraph. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GLib/GObject wrapper for the Facebook Graph API that integrates with GNOME...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current pidgin Vulnerability (SSA:2022-120-01)

The version of pidgin installed on the remote host is prior to 2.12.0 / 2.14.9. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-120-01 advisory. - An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client...

Huawei EulerOS: Security Advisory for grilo (EulerOS-SA-2022-1535)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...