GHSA-8MPP-F3F7-XC28 Jetty SslConnection does not release pooled ByteBuffers in case of errors

Impact SslConnection does not release ByteBuffers in case of error code paths. For example, TLS handshakes that require client-auth with clients that send expired certificates will trigger a TLS handshake errors and the ByteBuffers used to process the TLS handshake will be leaked. Workarounds...

gnutls -- double free vulnerability

The GnuTLS project reports: When gnutlspkcs7verify cannot verify signature against given trust list, it starts creating a chain of certificates starting from identified signer up to known root. During the creation of this chain the signer certificate gets freed which results in double free when t...

kernel security and bug fix update

3.10.0-1160.71.1.0.1 - debug: lock down kgdb Orabug: 34270798 CVE-2022-21499 3.10.0-1160.71.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 -...

[SECURITY] Fedora 36 Update: golang-github-googlecloudplatform-cloudsql-proxy-1.19.1-6.fc36

The Cloud SQL Proxy allows a user with the appropriate permissions to connect to a Second Generation Cloud SQL database without having to deal with IP whitelisting or SSL certificates manually. It works by opening unix/tcp sockets on the local machine and proxying connections to the associated...

RHEL 8 : compat-openssl10 (RHSA-2022:5326)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:5326 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

compat-openssl10 security update

1:1.0.2o-4 - Fix CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates Resolves: rhbz2077417...

Oracle Linux 8 : compat-openssl10 (ELSA-2022-5326)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-5326 advisory. 1:1.0.2o-4 - Fix CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates Resolves: rhbz2077417 Tenable has extracted the preceding...

GSD-2022-1003701 efi: Do not import certificates from UEFI Secure Boot for T2 Macs

efi: Do not import certificates from UEFI Secure Boot for T2 Macs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

CLSA-2022-1656430897 Fix CVE(s): CVE-2022-27781

SECURITY UPDATE: malicious server could make libcurl get stuck in a never-ending busy-loop when trying to retrieve cert information - debian/patches/CVE-2022-27781.patch: add maximum value of possible traversed certificates - CVE-2022-27781...

RLSA-2022:5326 Low: compat-openssl10 security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. compat-openssl10 provides the legacy 1.0 version of OpenSSL for use with older binaries. Security Fixes: compat-openssl10:...

OpenSSL 3.0.0 < 3.0.4 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.0.4. It is, therefore, affected by a vulnerability as referenced in the 3.0.4 advisory. - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not...

CLSA-2022-1655757814 Fix CVE(s): CVE-2020-1938, CVE-2020-9484, CVE-2021-25329

Fix build process: - debian/keystores/.pem|.jks: update expiring certs and keystores - debian/patches/0028-update-expiring-test-certs.patch: update expiring test certs - debian/patches/0029-fix-path-to-valid-keystore.patch: fix path to valid keystore - debian/patches/0030-use-tls12-in-tests.patch...

Malicious code in perf-keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9003463e95619d4e40f5507d682e1e9f6c51dfe0d607c8397e22babb820bd8d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5286 Malicious code in perf-keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9003463e95619d4e40f5507d682e1e9f6c51dfe0d607c8397e22babb820bd8d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61c1bd039b542d545b48d15bcdca6e37e54dc5ae548505d5e73876be42977eec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4150 Malicious code in keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61c1bd039b542d545b48d15bcdca6e37e54dc5ae548505d5e73876be42977eec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @azure-tests/perf-keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a25dc4068b608b772eecbeda0f61b9fdc2db99958e7ed44bb311e99ff4083afb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-104 Malicious code in @azure-tests/perf-keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a25dc4068b608b772eecbeda0f61b9fdc2db99958e7ed44bb311e99ff4083afb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-certificates-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d4a4dd27ca78c3baf11188004219aee2dde382de300b316e2276af5c2613b81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1345 Malicious code in azure-keyvault-certificates-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95f4c241905d9e557472c20ba2fce0d7a9246b1fd912f2b680a906e98699f866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...