SUSE-SU-2024:1179-1 Security update for gnutls

This update for gnutls fixes the following issues: Security issues fixed: - CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange bsc1208143. - CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange bsc1217277. - CVE-2024-0567: Fixed an incorrect rejection of...

io.vertx:vertx-core: memory leak when a TCP server is configured with TLS and SNI support

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading...

WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score < 7.1.0 - Sensitive Information Exposure via insufficiently protected files

Description The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2024:1147-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1147-1 advisory. - Mozilla Thunderbird 115.9 bsc1221327 - CVE-2024-0743: Crash in NSS TLS method - CVE-2024-2605:...

AZL-39794 CVE-2024-2511 affecting package openssl for versions less than 3.3.0-1

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in...

AZL-40192 CVE-2024-2511 affecting package edk2 for versions less than 20240524git3e722403cd16-8

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in...

AZL-42949 CVE-2024-2511 affecting package openssl for versions less than 1.1.1k-30

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in...

AZL-78543 CVE-2024-2511 affecting package openssl-fips-provider 3.1.2-2

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in...

AZL-42700 CVE-2024-2511 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-1

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in...

Security Bulletin: Vulnerabilities in cryptography and Jinja [CVE-2023-50782, CVE-2024-22195]

Summary IBM Storage Protect Plus Microsoft File Systems Backup and Restore can be affected by vulnerabilities in cryptography and Jinja which include obtain sensitive information and cross-site scripting, as described by the CVEs in the "Vulnerability Details" section. These vulnerabilities have...

SUSE-SU-2024:1147-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 115.9 bsc1221327 - CVE-2024-0743: Crash in NSS TLS method - CVE-2024-2605: Windows Error Reporter could be used as a Sandbox escape vector - CVE-2024-2607: JIT code failed to save return registers on Armv7-A -...

CentOS 8 : firefox (CESA-2024:1484)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:1484 advisory. - NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the...

OpenSSL 1.1.1 < 1.1.1y Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.1.1y. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1y advisory. - Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impac...

The vulnerability of the `curl_wssl_init_ctx` function in the `vquic-tls.c` component of the command-line utility CURL allows a attacker to bypass any certificate-related issues.

The vulnerability of the curlwsslinitctx function in the vquic-tls.c component of the command-line utility cURL is related to errors in the certificate validation process. Exploiting this vulnerability could allow a remote attacker to bypass any certificate-related issues...

IBM WebSphere Application Server Encryption Problem Vulnerability (CNVD-2024-20496)

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. An encryption issue vulnerability exists in IBM WebSpher...

CentOS 8 : thunderbird (CESA-2024:1494)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:1494 advisory. - NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the...

Improper Certificate Validation

github.com/hashicorp/vault vulnerable to Improper Certificate Validation. The vulnerability exists due to inadequate validation during the TLS certificate authentication process, specifically in handling OCSP responses when one or more OCSP sources are configured...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) could provide weaker than expected security (CVE-2023-50313)

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM could provide weaker than expected security for outbound TLS connections.Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a security...

TLS Certificate Check Bypass

libcurl is vulnerable to TLS Certificate Check Bypass. The vulnerability is caused due to libcurl not checking the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the...

Mageia: Security Advisory (MGASA-2024-0084)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...