WS-2026-0012

OpenSSL TLS/DTLS handshake memory-bloat DoS "HollowByte": when reading a handshake message, tlsgetmessagebody allocated the initbuf to the full message size declared in the 4-byte handshake header before the payload data arrived. A remote peer can send a tiny 11-byte message header claiming a ver...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a man-in-the-middle attack in OpenSSL [CVE-2024-12797]

Summary IBM Watson Speech Services Cartridge is vulnerable to a man-in-the-middle attack in OpenSSL, caused by a failure to abort TLS/DTLS handshakes in RFC7250 Raw Public Key RPK authentication CVE-2024-12797. OpenSSL is used by our Speech runtimes. This vulnerabilitiy has been addressed. Please...