GO-2022-0213 Panic on invalid DSA public keys in crypto/dsa

Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don't chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server tha...

ISC BIND 9.18.0 < 9.18.3 Assertion Failure (cve-2022-1183)

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2022-1183 advisory. - An assertion failure can be triggered if a TLS connection to a configured http TLS listener with a defined endpoint is...

Oracle Linux 8 : pki-core:10.6 (ELSA-2022-1851)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1851 advisory. - Bug 2046022 - CVE-2021-4213 pki-core:10.6/jss: memory leak in TLS connection leads to OOM rhel-8 Tenable has extracted the preceding description block directl...

pki-core:10.6 security and bug fix update

jss 4.9.3-1 - Rebase to JSS 4.9.3 - Bug 2046022 - CVE-2021-4213 pki-core:10.6/jss: memory leak in TLS connection leads to OOM rhel-8 4.9.2-1 - Rebase to JSS 4.9.2 ldapjdk 4.23.0-1 - Rebase to LDAP SDK 4.23.0 4.23.0-0.1 - Rebase to LDAP SDK 4.23.0-alpha1 pki-core 10.12.0-2.0.1 - Remove upstream...

CURL-CVE-2022-27782 TLS and SSH connection too eager reuse

libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several TLS and...

Moderate: Red Hat Security Advisory: pki-core:10.6 security and bug fix update

An update for the pki-core:10.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ALSA-2022:1851 Moderate: pki-core:10.6 security and bug fix update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: JSS: memory leak in TLS connection leads to OOM CVE-2021-4213 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

Moderate: pki-core:10.6 security and bug fix update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: JSS: memory leak in TLS connection leads to OOM CVE-2021-4213 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

RLSA-2022:1851 Moderate: pki-core:10.6 security and bug fix update

The Public Key Infrastructure PKI Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fixes: JSS: memory leak in TLS connection leads to OOM CVE-2021-4213 For more details about the security issues, including the impact, a CVSS score,...

Mageia: Security Advisory (MGASA-2017-0230)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SINUMERIK Edge certificate improper validation vulnerability

Siemens SINUMERIK Edge is a combination of hardware and software that provides a machine-oriented system platform for applications that facilitate digital production support and optimization.SINUMERIK Edge Certificate Improper Validation VulnerabilityAffected software does not properly validate...

CVE-2021-44549 SMTPS server hostname not checked when making TLS connection to SMTPS server

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-42027

A vulnerability has been identified in SINUMERIK Edge All versions V3.2. The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and...

PT-2021-23478

Name of the Vulnerable Software and Affected Versions SINUMERIK Edge versions prior to V3.2 Description A security issue has been identified where the affected software fails to properly validate the server certificate when establishing a TLS connection. This could enable an attacker to impersona...

CVE-2021-42027: Improper Certificate Validation

A vulnerability has been identified in SINUMERIK Edge All versions V3.2. The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and...

Huawei EulerOS: Security Advisory for squid (EulerOS-SA-2021-2433)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-38165

A flaw was found in the way lynx parsed URLs with userinfo part containing authentication credentials. These credentials were included in the Server Name Indication SNI TLS extension data and sent unencrypted during the TLS connection handshake. This could lead to exposure of authentication...

Design/Logic Flaw

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command line tool.When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificat...

Code injection

Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept function in the run-loop for a TCP socket/TLS socket/TCP+TLS multi-socket causes an early exit from the run loop that should continue infinitely unless terminated by a local user...

CVE-2021-22926

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command line tool.When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificat...