LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks

A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange for both export and non-export grade cipher suites. An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lea...

TLS protocol man-in-the-middle attack vulnerability

TLS Transport Layer Security is a set of protocols used to provide confidentiality and data integrity between two communicating applications. A security vulnerability exists in the TLS protocol version 1.2 and earlier. When the server enabled the DHEEXPORT cipher suite, the program failed to...

UBUNTU-CVE-2015-0971

The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service crash via vectors related to SSL/TLS certificates...

Microsoft windows Schannel weak Diffie-Hellman ephemeral key length sensitive information disclosure vulnerability

Microsoft Windows is a popular operating system. A security vulnerability exists in Microsoft Windows Schannel when a 512-bit weak Diffie-Hellman ephemeral key length is used in an encrypted TLS session, which allows remote attackers to decrypt the weak key and obtain sensitive information by...

JDK: ephemeral RSA keys accepted for non-export SSL/TLS cipher suites (FREAK)

GSKit in IBM Tivoli Directory Server ITDS 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server ISDS 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict T...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

IBM JDK Java Denial of Service Vulnerability

IBM Java is a JRE runtime environment. An unspecified security vulnerability in the IBM JDK Java Virtual Machine's Socket Extension Provider for handling TLS and SSL connections allows attackers to conduct denial-of-service attacks by exploiting the vulnerability...

Salt (SaltStack) modules/splunk_search.py create() certificate validation bypass vulnerability

SaltStack is a new infrastructure platform management tool. The create function in SaltStack modules/splunksearch.py fails to properly validate x.509 certificates, allowing remote attackers to forge certificates to spoof TLS/SSL servers and conduct communication interception attacks...

Asterisk Open Source/Certified Asterisk Certificate Validation Vulnerability

Asterisk is a free software, open source software that implements the functionality of a telephone user switch PBX. Asterisk Open Source has a security vulnerability due to a failure to properly handle domain names in the CN field of an X.509 certificate when registering a SIP TLS device. Allowin...

CVE-2015-2808

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

PT-2015-5903

Name of the Vulnerable Software and Affected Versions RC4 affected versions not specified Description The RC4 algorithm, used in the TLS and SSL protocols, does not properly combine state data with key data during the initialization phase. This weakness, known as the Invariance Weakness, allows...

openssl: invalid pointer use in ASN1_TYPE_cmp()

An invalid pointer use flaw was found in OpenSSL's ASN1TYPEcmp function. A remote attacker could crash a TLS/SSL client or server using OpenSSL via a specially crafted X.509 certificate when the attacker-supplied certificate was verified by the application...

openssl: assertion failure in SSLv2 servers

A denial of service flaw was found in the way OpenSSL handled SSLv2 handshake messages. A remote attacker could use this flaw to cause a TLS/SSL server using OpenSSL to exit on a failed assertion if it had both the SSLv2 protocol and EXPORT-grade cipher suites enabled...

Moderate: Red Hat Security Advisory: openssl security update

Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...

PT-2016-1330 · Openssl +6 · Openssl +7

Name of the Vulnerable Software and Affected Versions: OpenSSL versions prior to 0.9.8zf OpenSSL versions prior to 1.0.0r OpenSSL versions prior to 1.0.1m OpenSSL versions prior to 1.0.2a Description: The issue allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS...

Python Restkit TLS Certificate Validation Security Bypass Vulnerability

Python is an object-oriented, straightforward computer programming language. A security vulnerability exists in Python Restkit TLS certificate validation. This allows attackers to exploit the vulnerability to obtain sensitive information via a man-in-the-middle attack...

UBUNTU-CVE-2015-2320

The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback...

Microsoft Secure Channel Man-in-the-Middle Security Bypass Vulnerability

Microsoft Windows is a popular operating system. Microsoft Secure Channel in Windows fails to properly restrict tls state transitions, allowing attackers to exploit vulnerabilities to submit special tls communications for freak attacks that can drop the encryption level to exportrsa encryption,...

Unspecified Vulnerability in Secure Transport for Multiple Apple Products

Apple iOS, Apple TV, and Apple OS X are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Apple TV is a high-definition television set-top box; and Apple OS X is a specialized operating system developed for Mac computers. A security vulnerability exists in Secu...