Capital One: Building Security Into DevOps

Capital One prides itself on staying at the forefront of IT innovations to give its business a competitive edge. For example, it adopted Agile software-development methodologies years ago, and uses artificial intelligence and machine learning. It was the first bank to implement a mobile wallet wi...

AMI BIOS System Management Mode Vulnerability - Lenovo Support US

No description provided...

AMI BIOS System Management Mode Vulnerability - US

Lenovo Security Advisory: LEN-24238 Potential Impact: Information disclosure, code execution Severity: Medium Scope of Impact: Industry-wide Summary Description: AMI has reported to Lenovo that the System Management Mode SMM module was not properly validating buffers in the BIOS supplied by AMI...

AMI Firmware Permits Microcode Downgrade - Lenovo Support US

No description provided...

AMI Firmware Permits Microcode Downgrade - US

Lenovo Security Advisory: LEN-24239 Potential Impact: Unauthorized microcode downgrade Severity: Medium Scope of Impact: Industry-wide Summary Description: AMI has reported to Lenovo that the BIOS supplied by AMI may allow an attacker to revert the CPU firmware to an older version. Mitigation...

Amazon Linux AMI : tomcat7 (ALAS-2018-1099)

When the default servlet in Apache Tomcat versions 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.CVE-2018-11784 C Tenable...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2018-1097)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

Amazon Linux AMI : openssl (ALAS-2018-1098)

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...

Amazon Linux AMI : nss (ALAS-2018-1095)

A flaw was found in the way NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. A man-in-the-middle attacker could use this flaw in a passive replay attack.CVE-2018-12384 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Amazon Linux AMI : 389-ds-base (ALAS-2018-1094)

A vulnerability was discovered in 389-ds-base. The lock controlling the error log was not correctly used when re-opening the log file in logerroremergency. An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.CVE-2018-14624 A race condition was foun...

Amazon Linux AMI : php56 / php70, php71, php72 (ALAS-2018-1090)

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a 'Transfer-Encoding: chunked' request, because the bucket brigade is mishandled in the phphandler function in sapi/apache2handler/sapiapache2.c. CVE-2018-17082...

Amazon Linux AMI : kernel (ALAS-2018-1086)

A security flaw was found in the chapservercomputemd5 function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The atta...

Amazon Linux AMI : kernel (ALAS-2018-1087)

NOTE: CVE-2018-14634 was already fixed in the 4.14 kernel released with the 2018.03 AMI release. The advisory release date does not accurately reflect the date this was fixed. The actual date of the fix being released is: 2018-04-23. An integer overflow flaw was found in the Linux kernel's...

Amazon Linux AMI : procmail (ALAS-2018-1084)

A heap-based buffer overflow flaw was found in procmail's formail utility. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail.CVE-2017-16844 C Tenable Network Securit...

Amazon Linux AMI : bind (ALAS-2018-1082)

A denial of service flaw was discovered in bind versions that include the 'deny-answer-aliases' feature. This flaw may allow a remote attacker to trigger an INSIST assert in named leading to termination of the process and a denial of service condition.CVE-2018-5740 C Tenable Network Security, Inc...

Amazon Linux AMI : postgresql93 / postgresql94,postgresql95 (ALAS-2018-1079)

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side...

Amazon Linux AMI : squid (ALAS-2018-1081)

The Squid Software Foundation Squid HTTP Caching Proxy contains a NULL pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with...

Amazon Linux AMI : ntp (ALAS-2018-1083)

ntpd in ntp 4.2.x before 4.2.8p7 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for...

Amazon Linux AMI : postgresql92 (ALAS-2018-1080)

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side...

Amazon Linux AMI : krb5 (ALAS-2018-1010)

A denial of service flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to exit with an assertion failure by making an invalid S4U2Self or S4U2Proxy request.CVE-2017-11368 An authentication bypass flaw was found in the way krb5's certauth...