CVE-2019-12656

A vulnerability in the IOx application environment of multiple Cisco platforms could allow an unauthenticated, remote attacker to cause the IOx web server to stop processing HTTPS requests, resulting in a denial of service DoS condition. The vulnerability is due to a Transport Layer Security TLS...

qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

Security update for python-Twisted (moderate)

openSUSE Security Update: Security update for python-Twisted Announcement ID: openSUSE-SU-2019:2110-1 Rating: moderate References: 1138461 Cross-References: CVE-2019-12855 Affected Products: openSUSE Backports SLE-15 An update that fixes one vulnerability is now available. Description: This updat...

Moderate: Red Hat Security Advisory: qpid-proton security update

An update for qpid-proton is now available for Red Hat OpenStack Platform 14 Rocky. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: qpid-proton security update

An update for qpid-proton is now available for Red Hat OpenStack Platform 13 Queens. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Code injection

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 C library and its language bindings can connect to a peer anonymously using TLS even when configured to verify the peer certificate while used with OpenSSL versions before...

Improper Certificate Validation

Overview qpidproton is a Proton is a high performance, lightweight messaging library. It can be used in the widest range of messaging applications including brokers, client libraries, routers, bridges, proxies, and more. Proton is based on the AMQP 1.0 messaging standard. Affected versions of thi...

DEBIAN-CVE-2019-0223

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 C library and its language bindings can connect to a peer anonymously using TLS even when configured to verify the peer certificate while used with OpenSSL versions before...

CVE-2019-0223

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 C library and its language bindings can connect to a peer anonymously using TLS even when configured to verify the peer certificate while used with OpenSSL versions before...

CVE-2019-4055

Summary: CVE-2019-4055 affects IBM MQ versions 8.0.0.0–8.0.0.10, 9.0.0.0–9.0.0.5, and 9.1.0.0–9.1.1, enabling a denial-of-service through the TLS key renegotiation function. The root cause is a weakness in TLS renegotiation handling. Impact (as described): DoS affecting MQ services. Remediation/F...

Input validation

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

openSUSE Security Update : python-urllib3 (openSUSE-2019-159)

This update for python-urllib3 fixes the following issues : python-urllib3 was updated to version 1.22 fate326733, bsc1110422 and contains new features and lots of bugfixes : The full changelog can be found on : https://github.com/Lukasa/urllib3/blob/1.22/CHANGES.rst Security issues fixed : -...

PT-2019-1202

Name of the Vulnerable Software and Affected Versions MySQL Connectors versions 8.0.13 and prior MySQL Connectors versions 2.1.8 and prior Description The issue is related to errors in the code of the Connector/Python subcomponent of MySQL Connectors. It allows a remote attacker to gain...

CVE-2018-17187

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...

F5 Networks BIG-IP : TLS vulnerability (K02714910)

In some circumstances, the Traffic Management Microkernel TMM does not properly handle certain malformed TLS1.2 records, which allows remote attackers to cause a denial-of-service DoS or possible remote command execution on the BIG-IP system. CVE-2017-6164 Impact A remote attacker may be able cau...

Unspecified Vulnerability in Intel Active Management Technology

Intel Active Management Technology AMT is an embedded system from the U.S. company Intel Intel that is integrated into the Intel chip and uses active management technology. A security vulnerability exists in the TLS implementation in Intel AMT versions prior to 12.0.5. An attacker could exploit t...

Security Bulletin: TLS padding vulnerability affects IBM Rational ClearCase (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Rational ClearCase. Vulnerability Details CVE-ID: CVE-2014-8730 Description: IBM Rational ClearCase could allow a remote attacker to obtain sensitive...

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

Security Bulletin: TLS padding vulnerability affects IBM HTTP Server shipped with IBM Presence Zones (CVE-2014-8730)

Summary IBM HTTP Server is shipped as a component of IBM Presence Zones. Information about a security vulnerability affecting IBM HTTP Server has been published in a security bulletin. Vulnerability Details Consult the TLS padding vulnerability affects IBM HTTP Server CVE-2014-8730 security...

Security Bulletin: Vulnerability in TLS affects IBM Tivoli Monitoring (CVE-2014-8730 )

Summary A new variant of the Padding Oracle On Downgraded Legacy Encryption POODLE attack for TLS may affect IBM Tivoli Monitoring ITM. Vulnerability Details CVEID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by the failure to check the...