SUSE SLED15 / SLES15 Security Update : glib-networking (SUSE-SU-2021:3944-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3944-1 advisory. Update to version 2.62.4: - CVE-2020-13645: Fixed a connection failure when the server identity is unset bsc1172460. Tenable has extracted the...

Updated gfbgraph packages fix security vulnerability

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...

MGASA-2021-0530 Updated gfbgraph packages fix security vulnerability

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...

CVE-2021-3935

When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1...

CVE-2021-3935

When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1...

CVE-2021-3935

CVE-2021-3935 affects PgBouncer when configured to use certificate authentication. A man-in-the-middle can inject arbitrary SQL queries at the first connection, even with TLS verification, in versions prior to 1.16.1. The root cause is not detailed in the initial document, but multiple connected ...

X (Formerly Twitter): Subdomain takeover of images.crossinstall.com

Summary images.crossinstall.com points to an AWS S3 bucket that no longer exists. I was able to take control of this bucket and put my own content onto it. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing to anything...

Debian DSA-5011-1 : salt - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5011 advisory. - An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allo...

Oracle Linux 8 : grilo (ELSA-2021-4339)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4339 advisory. 0.3.6-3 + grilo-0.3.6-3 - Fix TLS not being validated correctly - Resolves: rhbz1997234 Tenable has extracted the preceding description block directly from the...

Debian DLA-2815-1 : salt - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2815 advisory. Multiple security vulnerabilities have been discovered in Salt, a powerful remote execution manager, that allow for local privilege escalation on a minion, server...

CentOS 8 : grilo (CESA-2021:4339)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4339 advisory. - grilo: missing TLS certificate verification CVE-2021-39365 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Updated libzapojit packages fix security vulnerability

In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. CVE-2021-39360...

ALSA-2021:4339 Moderate: grilo security update

Grilo is a framework that provides access to different sources of multimedia content, using a pluggable system. The grilo package contains the core library and elements. Security Fixes: grilo: missing TLS certificate verification CVE-2021-39365 For more details about the security issues, includin...

Moderate: grilo security update

Grilo is a framework that provides access to different sources of multimedia content, using a pluggable system. The grilo package contains the core library and elements. Security Fixes: grilo: missing TLS certificate verification CVE-2021-39365 For more details about the security issues, includin...

grilo security update

An update is available for grilo. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grilo is a framework that provides access to different sources of multimedia...

Python < 2.7.9, 3.4.x < 3.4.3 Validate TLS certificate (bpo-22417) - Linux

Python is prone to a man-in-the-middle vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescripti...

MGASA-2021-0472 Updated grilo packages fix security vulnerability

Michael Catanzaro reported a problem in Grilo, a framework for discovering and browsing media. TLS certificate verification is not enabled on the SoupSessionAsync objects created by Grilo, leaving users vulnerable to network MITM attacks...

Updated grilo packages fix security vulnerability

Michael Catanzaro reported a problem in Grilo, a framework for discovering and browsing media. TLS certificate verification is not enabled on the SoupSessionAsync objects created by Grilo, leaving users vulnerable to network MITM attacks...

Denial Of Service (DoS)

squid:sid is vulnerable to denial of service. Lack of secure certificate validation of TLS server certificates allows a remote server to obtain security trust when the trust is not valid. This indication of trust may be passed along to clients allowing access to unsafe or hijacked services...

SUSE SLES15: grilo-devel / libgrilo-0_3-0 / libgrlnet-0_3-0 / libgrlpls-0_3-0 / etc (SUSE-SU-2021:3295-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3295-1 advisory. - CVE-2021-39365: Fixed missing TLS certificate verification bsc1189839. Tenable has extracted the preceding description block directly from...