VMware vCenter Forge SAML Authentication Credentials

This module forges valid SAML credentials for vCenter server using the vCenter SSO IdP certificate, IdP private key, and VMCA certificates as input objects; you must also provide the vCenter SSO domain name and vCenter FQDN. The module will return a session cookie for the /ui path that grants...

SUSE-SU-2022:0845-2 Security update for chrony

This update for chrony fixes the following issues: Chrony was updated to 4.1, bringing features and bugfixes. Update to 4.1 Add support for NTS servers specified by IP address matching Subject Alternative Name in server certificate Add source-specific configuration of trusted certificates Allow...

Privilege Escalation

vault is vulnerable to privilege escalation. The vulnerability exists because the wildcard certificates are authorized when the PKI role policy attribute is set to false which allows an attacker to gain access to the system...

Access Restriction Bypass

nginx is vulnerable to access restriction bypass. The vulnerability exists because TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates which allows an attacker to gain access to the system and perform unauthorized actions...

Denial Of Service (DoS)

GO is vulnerable to denial of service. The vulnerability exists due to a panic on macOS when presented with certain malformed certificates...

Fedora: Security Advisory for nss (FEDORA-2022-ea66694ce2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-5371-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 34 Update: nss-3.77.0-1.fc34

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

SUSE-SU-2022:1167-1 Security update for go1.17

This update for go1.17 fixes the following issues: Update to version 1.17.8 bsc1190649: - CVE-2022-24921: Fixed a potential denial of service via large regular expressions bsc1196732. Non-security fixes: - Fixed an issue with v2 modules go51332. - Fixed an issue when building source in riscv64...

Fedora: Security Advisory for nss (FEDORA-2022-3781e69ebd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

go -- multiple vulnerabilities

The Go project reports: encoding/pem: fix stack overflow in Decode. A large more than 5 MB PEM input can cause a stack overflow in Decode, leading the program to crash. crypto/elliptic: tolerate all oversized scalars in generic P-256. A crafted scalar input longer than 32 bytes can cause...

Rocky Linux 8 : openssl (RLSA-2022:1065)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1065 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function i...

Deep Panda deploys new rootkit “Fire Chili” by exploiting Log4shell in VMware horizon

THREAT LEVEL: Red For a detailed advisory, download the pdf file here Deep Panda, a Chinese APT group, took advantage of the well-known Log4Shell vulnerability in VMware Horizon servers to deploy a backdoor, rootkit, and steal sensitive data. This threat actor is primarily targeting firms in the...

ALPACA is an application layer protocol content confusion attack exploiting TLS servers implementing different protocols but using compatible certificates such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

...

The vulnerability of the function of the NextCloud clipboard synchronization tool, which allows a hacker to gain access to confidential data.

The vulnerability of the function of the client-side encryption tool for Nextcloud’s desktop synchronization platform relates to the lack of verification of the ownership of the private key of previously uploaded public certificates. Exploiting this vulnerability allows a malicious actor to gain...

RHEL 8 : openssl (RHSA-2022:1112)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1112 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

openssl security update

1:1.1.1k-6 - Fixes CVE-2022-0778 openssl: Infinite loop in BNmodsqrt reachable when parsing certificates - Resolves: rhbz2067144...

Oracle Linux 7 : openssl (ELSA-2022-9249)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9249 advisory. - Fixes CVE-2022-2078 Infinite loop in BNmodsqrt reachable when parsing certificates Tenable has extracted the preceding description block directly from the...

openssl security update

1.0.2k-25fips - Change Epoch from 1 to 10 - Fix DH self-test to add shared secret comparison Orabug: 32467026 - Add DH support changes for SP 800-56A rev3 requirements Orabug: 32467059 - Add TLS KDF self-test Orabug: 32467193 - Add EC keys pairwise consistency test Orabug: 32467059 1:1.0.2k-25 -...

Oracle Linux 7 : openssl (ELSA-2022-1066)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1066 advisory. - Fixes CVE-2022-2078 Infinite loop in BNmodsqrt reachable when parsing certificates Tenable has extracted the preceding description block directly from the...