PT-2021-3729 · Red Hat · Openshift

Name of the Vulnerable Software and Affected Versions: OpenShift versions prior to 4.8 Description: The issue is related to the generated certificate for the in-cluster Service CA in OpenShift, which incorrectly includes additional certificates. This allows an attacker that compromises any of the...

openshift: Injected service-ca.crt incorrectly contains additional internal CAs

It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificate...

China's New Law Requires Vendors to Report Zero-Day Bugs to Government

The Cyberspace Administration of China CAC has issued new stricter vulnerability disclosure regulations that mandate software and networking vendors affected with critical flaws to mandatorily disclose them first-hand to the government authorities within two days of filing a report. The...

Police seize illegal cryptomining farm using thousands of PS4s, GPUs

By Deeba Ahmed Ukrainian authorities have seized the illegal cryptomining farm and recovered 3,800 PlayStation 4 gaming consoles and GPUs. This is a post from HackRead.com Read the original post: Police seize illegal cryptomining farm using thousands of PS4s, GPUs...

Domain, server of DoubleVPN used by ransomware gangs seized

By Deeba Ahmed US, Canada, and European authorities took part in the operation which ended up seizing cybercriminals' access to and infrastructure of DoubleVPN. This is a post from HackRead.com Read the original post: Domain, server of DoubleVPN used by ransomware gangs seized...

EU to Launch Bloc-wide Rapid Response Joint Cyber Unit

By Deeba Ahmed The task force is quite similar to Washington’s ransomware task force, but the EU’s version will coordinate with authorities across the bloc. This is a post from HackRead.com Read the original post: EU to Launch Bloc-wide Rapid Response Joint Cyber Unit...

US seizes official website of Iranian state-owned Press TV

By Waqas With Press TV; there are at least 6 regional websites that are currently displaying notices of seizure apparently uploaded by the US authorities. This is a post from HackRead.com Read the original post: US seizes official website of Iranian state-owned Press TV...

Exploitation of Accellion File Transfer Appliance

Summary This joint advisory is the result of a collaborative effort by the cybersecurity authorities of Australia,1 New Zealand,2 Singapore,3 the United Kingdom,4 and the United States.56 These authorities are aware of cyber actors exploiting vulnerabilities in Accellion File Transfer Appliance...

Oracle Linux 8 : tigervnc (ELSA-2021-1783)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1783 advisory. 1.11.0-6 - Use GNOME as default session Resolves: bz1853608 1.11.0-5 - Make sure we log properly output to journal actually log to syslog Resolves: bz1841537...

Insecure TLS Configuration

tigervnc uses insecure TLS configuration. Mishandling of TLS certificate exceptions in rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java allows the owner of a certificate to impersonate any server after a client had added an exception since the certificates are stored as authorities...

RHEL 8 : tigervnc (RHSA-2021:1783)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1783 advisory. Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine where it ...

tigervnc: certificate exceptions stored as authorities

In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception...

DEBIAN-CVE-2021-28090

Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002...

CVE-2021-28090

Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002...

UBUNTU-CVE-2021-28090

Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002...

Top Russian hacker forums Maza, Verified hacked; data leaked online

By Waqas It is unclear who hacked these forums but insider discussion believes government authorities were behind the attack as a "friendly warning" message. This is a post from HackRead.com Read the original post: Top Russian hacker forums Maza, Verified hacked; data leaked online...

Russian Hackers Targeted Ukraine Authorities With Supply-Chain Malware Attack

Ukraine is formally pointing fingers at Russian hackers for hacking into one of its government systems and attempting to plant and distribute malicious documents that would install malware on target systems of public authorities. "The purpose of the attack was the mass contamination of informatio...

Mexican Politician Removed Over Alleged Ties to Romanian ATM Skimmer Gang

The leader of Mexicos Green Party has been removed from office following allegations that he received money from a Romanian ATM skimmer gang that stole hundreds of millions of dollars from tourists visiting Mexicos top tourist destinations over the past five years. The scandal is the latest fallo...

Clearview Facial-Recognition Technology Ruled Illegal in Canada

Canadian authorities have found that the collection of facial-recognition data by Clearview AI is illegal because it violates federal and provincial privacy laws, representing a win for individuals’ privacy and potentially setting a precedent for other legal challenges to the controversial...

USN-4719-1 ca-certificates update

The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.46 version of the Mozilla certificate authority bundle...