OpenJDK: Weak ciphers preferred over stronger ones for TLS (JSSE, 8264210)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated...

UBUNTU-CVE-2021-35565

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacke...

PT-2021-7894

Name of the Vulnerable Software and Affected Versions Java SE versions 8u301, 11.0.12, 17 Oracle GraalVM Enterprise Edition versions 20.3.3 and 21.2.0 Description The issue is related to the JSSE component and allows an unauthenticated attacker with network access via TLS to compromise Java SE an...

Code injection

When curl = 7.20.0 and = 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instea...

Debian DLA-2751-1 : postgresql-9.6 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2751 advisory. PostgreSQL 9.6.23 fixes this security issue: Disallow SSL renegotiation more completely Michael Paquier SSL renegotiation has been disabled for some time, but the server...

CVE-2021-39365

In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...

DEBIAN-CVE-2020-36478

An issue was discovered in Mbed TLS before 2.25.0 and before 2.16.9 LTS and before 2.7.18 LTS. A NULL algorithm parameters entry looks identical to an array of REAL size zero and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate...

ARM mbed TLS 信任管理问题漏洞

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption capabilities for mbed products. A security vulnerability exists in ARM mbed TLS prior to version 2.24.0, which stems from an error in the validation handling of X.509 certificates when matching the expected...

CVE-2021-39365

In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...

CVE-2021-39365

CVE-2021-39365 affects GNOME Grilo with TLS certificate verification disabled on SoupSessionAsync/SoupSessionSync (grl-net-wc.c). Connected advisories show mitigations via upgraded Grilo packages in several distros (e.g., Debian bullseye 0.3.13-1+deb11u1; Mageia updates; AlmaLinux ALAS2 advisorie...

SUSE: Security Advisory (SUSE-SU-2021:2771-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[ASA-202107-42] go: denial of service

Arch Linux Security Advisory ASA-202107-42 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-34558 Package : go Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2147 Summary ======= The package go before version 2:1.16.6-1 ...

Arm Mbed TLS 安全漏洞

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption for mbed products. A security vulnerability exists in Arm Mbed TLS versions prior to 2.23.0, which stems from the fact that a side channel in a mode power can disclose an RSA private key used in a secure encla...

Security Bulletin: IBM MQ Appliance vulnerability in TLS (CVE-2020-4831)

Summary IBM MQ Appliance has resolved a TLS vulnerability first reported against the IBM DataPower Gateway. Vulnerability Details CVEID: CVE-2020-4831 DESCRIPTION: IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to...

Security Bulletin: Potential TLS vulnerability using Diffie-Hellman TLS ciphersuites in IBM DataPower Gateway (CVE-2020-1968)

Summary IBM has addressed the relevant CVE CVE-2020-1968 Vulnerability Details CVEID: CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections which have...

Cisco Firepower Threat Defense 1000 Series Bleichenbacher Attack (cisco-sa-asaftd-tls-bb-2g9uWkP)

According to its self-reported version, the TLS handler of Cisco Firepower Threat Defense FTD Software for Cisco Firepower 1000 Series firewalls is affected by the Bleichenbacher attack vulnerability due to improper implementation of countermeasures against the Bleichenbacher attack for cipher...

Cisco Adaptive Security Appliance Software Bleichenbacher Attack (cisco-sa-asaftd-tls-bb-2g9uWkP)

According to its self-reported version, the TLS handler of Cisco Adaptive Security Appliance ASA Software for Cisco Firepower 1000 is affected by the Bleichenbacher attack vulnerability due to improper implementation of countermeasures against the Bleichenbacher attack for cipher suites that rely...

CVE-2021-1402

A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to insufficient validati...

New WhatsApp Bugs Could've Let Attackers Hack Your Phone Remotely

Facebook-owned WhatsApp recently addressed two security vulnerabilities in its messaging app for Android that could have been exploited to execute malicious code remotely on the device and even exfiltrate sensitive information. The flaws take aim at devices running Android versions up to and...

PT-2021-6813

Name of the Vulnerable Software and Affected Versions Mbed TLS version 2.24.0 Description A side-channel vulnerability in base64 PEM file decoding exists, allowing system-level attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software runni...