120 matches found
DEBIAN-CVE-2019-0215
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in modssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions...
Security update for openssl (moderate)
openSUSE Security Update: Security update for openssl Announcement ID: openSUSE-SU-2019:1175-1 Rating: moderate References: 1100078 1113975 1117951 1127080 Cross-References: CVE-2019-1559 Affected Products: openSUSE Leap 42.3 An update that solves one vulnerability and has three fixes is now...
SUSE-SU-2019:0803-1 Security update for openssl
This update for openssl fixes the following issues: Security issues fixed: - The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations bsc1117951 - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond...
openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-985)
This update for openssl-100 fixes the following issues : Security issues fixed : - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. - CVE-2018-5407: Added elliptic curve scalar multiplication timing attack defenses that fixes 'PortSmash' bsc1113534. Non-security...
The vulnerability of the Network Security Services library lies in the possibility of reducing the version of the TLS protocol used, allowing attackers to gain access to protected information.
The vulnerability of the Network Security Services library relates to the possibility of reducing the version of the TLS protocol used. Exploiting this vulnerability can allow an attacker to gain access to protected information through a secondary channel...
Citrix Endpoint Management TLS Version Deprecation
To improve the security of connections to Citrix Endpoint Management, Citrix will block any communication over Transport Layer Security TLS 1.0 and 1.1 as of March 15, 2019. NOTE: On-Prem CEM customers also can follow the same instructions on their MDM 443 and 8443 and MAM 443 Service or Service...
Error: "The underlying connection was closed..." when querying the Monitor Service OData endpoint
Clients that attempt to access data OData or other Citrix Services with TLS versions 1.0 and 1.1 fail to establish a connection. Clients using .NET Framework may raise the following error: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---...
SUSE SLED15 / SLES15 Security Update : openssl-1_0_0 (SUSE-SU-2018:4001-1)
This update for openssl-100 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. CVE-2018-5407: Added elliptic curve scalar multiplication timing attack defenses that fixes 'PortSmash' bsc1113534. Non-security issue...
openSUSE Security Update : openssl-1_0_0 (openSUSE-2018-1518)
This update for openssl-100 fixes the following issues : Security issues fixed : - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. - CVE-2018-5407: Added elliptic curve scalar multiplication timing attack defenses that fixes 'PortSmash' bsc1113534. Non-security...
openSUSE: Security Advisory for openssl-1_0_0 (openSUSE-SU-2018:4050-1)
The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Security update for openssl-1_0_0 (moderate)
This update for openssl-100 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. - CVE-2018-5407: Added elliptic curve scalar multiplication timing attack defenses that fixes "PortSmash" bsc1113534. Non-security...
SUSE SLED12 / SLES12 Security Update : openssl-1_0_0 (SUSE-SU-2018:3989-1)
This update for openssl-100 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses bsc1113534. Add missing timing side channel patch for...
Unable to add store account on the native receiver for windows on HP T620 Win 7 embedded OS machines
After installing newer versions of the Receiver for Windows, that are by default configured to use only TLS 1.1 or 1.2, users are not able to add a store and may see this error message: "Your account cannot be added using this mail address. Make sure you entered it correctly. You may need to ente...
nss: Potential use-after-free in TLS 1.2 server when verifying client authentication
A use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an application compiled against NSS to crash or, potentially, execute arbitrary code with the permission of the user running the...
OracleVM 3.3 / 3.4 : curl (OVMSA-2017-0059)
The remote OracleVM system is missing necessary patches to address critical security updates : - treat Negotiate authentication as connection-oriented CVE-2017-2628 - fix a bug in DNS caching code that causes a memory leak 1302893 - SSH: make CURLOPTSSHPUBLICKEYFILE treat '' as NULL 1260742 - use...
Khan Academy: SSL/TLS Vulnerability at khanacademy.org
CVE - 2011 - 3389 Description : The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle...
openssl: TLS protocol downgrade attack
A flaw was found in the way OpenSSL handled fragmented handshake packets. A man-in-the-middle attacker could use this flaw to force a TLS/SSL server using OpenSSL to use TLS 1.0, even if both the client and the server supported newer protocol versions...
MGASA-2014-0008 Updated openssl package fixes security vulnerability
A flaw was reported for OpenSSL 1.0.1e, that can cause application using OpenSSL to crash when using TLS version 1.2 CVE-2013-6449. Also, a NULL pointer reference issue has been fixed in SSLgetcertificate mga11549...
SOL10737 - SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541
A Man in the Middle attack allows an attacker to inject an arbitrary amount of chosen plain text into the application protocol stream data during a secure session renegotiation that uses SSL version 3.x or TLS version 1.x. This may provide an attacker the ability to perform arbitrary actions on...
