10071 matches found
USN-4307-1 apache2 update
As a security improvement, this update adds TLSv1.3 support to the Apache HTTP Server package in Ubuntu 18.04 LTS. TLSv1.3 is enabled by default, and in certain environments may cause compatibility issues. The SSLProtocol directive may be used to disable TLSv1.3 in these problematic environments...
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...
GHSA-5F37-GXVH-23V6 Remote code execution in PHPMailer
Impact The mailSend function in the default isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted Sender property. Patches Fixed in 5.2.18 Workaround...
envoy: Incorrect Access Control when using SDS with Combined Validation Context
An access control bypass vulnerability was found in envoy. When the same TLS secret is used across multiple resources, the client's data, such as the subject alternative name or hash, is not validated. This flaw could lead to a possible bypass of security restrictions...
envoy: TLS inspector bypassc
An access control bypass vulnerability was found in envoy. An attacker could send specially crafted packets over TLS v1.3 to possibly bypass security restrictions...
Let's Encrypt Revoking 3 Million TLS Certificates Issued Incorrectly Due to a Bug
The most popular free certificate signing authority Let's Encrypt is going to revoke more than 3 million TLS certificates within the next 24 hours that may have been issued wrongfully due to a bug in its Certificate Authority software. The bug, which Let's Encrypt confirmed on February 29 and was...
The vulnerability of the STARTTLS component of the Keycloak identity and access management software lies in implementation errors related to authentication procedures. This allows attackers to escalate their privileges.
The vulnerability of the STARTTLS component of the Keycloak identity and access management software is related to implementation errors in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...
Envoy Data Forgery Issue Vulnerability
Envoy is an open source distributed proxy server . A security vulnerability exists in Envoy 1.13.0 and earlier versions. An attacker can exploit this vulnerability by sending specially crafted packets over the TLS protocol to bypass security restrictions...
PT-2020-5141 · Cncf · Envoy
Name of the Vulnerable Software and Affected Versions: CNCF Envoy versions prior to 1.13.0 Description: The issue is related to insufficient authentication of data in the Envoy network software. It allows a remote attacker to bypass security restrictions by using only TLS 1.3, which could lead to...
nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string
An encoding error flaw exists in the Node.js code that is used to read a peer certificate in the TLS client authentication. An attacker can use this flaw to crash the process used to handle TLS client authentication...
nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string
An encoding error flaw exists in the Node.js code that is used to read a peer certificate in the TLS client authentication. An attacker can use this flaw to crash the process used to handle TLS client authentication...
nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string
An encoding error flaw exists in the Node.js code that is used to read a peer certificate in the TLS client authentication. An attacker can use this flaw to crash the process used to handle TLS client authentication...
Design/Logic Flaw
Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled...
curl: RTSP RTP buffer over-read
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage...
HTTP Response Splitting
Overview org.wso2.transport.http:org.wso2.transport.http.netty is a HTTP protocol handling implementations for C5 based products. Affected versions of this package are vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled. Remediation Upgrade...
Security Bulletin: A vulnerability have been identified in Netty shipped with IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library (CVE-2019-16869)
Summary Netty is a dependency component shipped with the IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library for Message Bus Integration. Information about security vulnerabilities affecting Netty has been published. CVE-2019-16869 Vulnerability Details CVEID: CVE-2019-16869...
Security Bulletin: A vulnerability has been identified in FasterXML Jackson library shipped with IBM Tivoli Netcool/OMNIbus Common Integration Libraries (CVE-2019-14540)
Summary FasterXML Jackson library is shipped as a component of IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library and Transformer for Message Bus Integration. Information about security vulnerabilities affecting FasterXML Jackson library has been published. Vulnerability Detai...
