CLSA-2023-1703612003 Fix CVE(s): CVE-2022-40433, CVE-2023-22067, CVE-2023-22081

Backport upstream releases 8u392 to 16.04 LTS CVEs fixed in 8u392: - CVE-2023-22067: IOR deserialization issue in CORBA - CVE-2023-22081: Certificate path validation issue Drop applied CVE-2022-40433.patch changes are already in the sources...

Improper Certificate Validation

Snowflake.data is vulnerable to Improper Certificate Validation. The vulnerability is due to not checking the Certificate Revocation List CRL when insecureMode is set to its default value of false. This allows an attacker with access to the private key of a correctly issued certificate to execute...

The vulnerability of the scanning function of SSL/TLS-protocol-based antivirus software from ESET, including ESET NOD32, ESET Internet Security, ESET Smart Security Premium, ESET Security Ultimate, ESET Endpoint Antivirus for Windows, ESET Endpoint Security for Windows, ESET Endpoint Antivirus for Linux, ESET Server Security for Windows Server (File Security for Microsoft Windows Server), ESET Mail Security for Microsoft Exchange Server, ESET Mail Security for IBM Domino, ESET Security for Microsoft SharePoint Server, ESET File Security for Microsoft Azure, and ESET Server Security for Linux, allows attackers to bypass the security measures.

The vulnerability of the scanning function of SSL/TLS-protection in ESET NOD32 antivirus software, ESET Internet Security, ESET Smart Security Premium, ESET Security Ultimate, ESET Endpoint Antivirus for Windows, ESET Endpoint Security for Windows, ESET Endpoint Antivirus for Linux, ESET Server...

The vulnerability of the TLS implementation of the RTU500 Scripting Interface for programming logic controllers from Hitachi Energy allows attackers to gain unauthorized access to protected information and perform spoofing attacks.

The vulnerability of the TLS implementation in the RTU500 Scripting Interface for programming logic controllers from Hitachi Energy relates to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information a...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to not checking the Certificate Revocation List CRL when insecureMode is set to its default value of false. An attacker with access to the private key of a correctly issued certificate and the ability...

Security Bulletin: IBM Storage Fusion HCI may be vulnerable to untrusted root certificates due Python Certifi (CVE-2022-23491, CVE-2023-37920)

Summary The Python Certifi package is present during IBM Storage Fusion HCI's deployment for TLS certificate validation. Vulnerabilities in this library could lead to the use of untrusted root certificates. Vulnerability Details CVEID:CVE-2022-23491 DESCRIPTION: An unspecified error in with...

CVE-2023-1514

A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority CA, allowing the client to validate th...

Design/Logic Flaw

A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority CA, allowing the client to validate th...

Hitachi Energy RTU500 Scripting Interface

SUMMARY Hitachi Energy is aware of a reported vulnerability in the RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority CA,...

PT-2023-7965 · Unknown · Rtu500 Scripting Interface

Name of the Vulnerable Software and Affected Versions: RTU500 Scripting interface affected versions not specified Description: A vulnerability exists in the RTU500 Scripting interface component. When a client connects to a server using TLS, the server presents a certificate that links a public ke...

CVE-2023-6680

An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication...

CVE-2023-6680

An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication...

UBUNTU-CVE-2023-6680

An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication...

Input validation

An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication...

CVE-2023-6680

An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication...

CVE-2023-6680 Improper Certificate Validation in GitLab

An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication...

CVE-2023-6680

Removed by vendor...

CVE-2023-6680 Improper Certificate Validation in GitLab

An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication...

CVE-2023-6680

CVE-2023-6680 affects GitLab Enterprise Edition (EE) Smartcard authentication. The issue is an improper certificate validation in the Smartcard authentication flow that, if enabled by an administrator (it is an experimental feature), allows an attacker to authenticate as another user using a publ...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2023-3425)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...