CVE-2022-4203

A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate...

K21942600: A virtual server with a Client SSL profile may accept non-SSL traffic

Security Advisory Description A Client SSL profile using a cipher group and an option that modifies supported ciphers for example no-dtls or no-ssl accepts plain text connections, in addition to correctly handling SSL traffic. This issue occurs when all of the following conditions are met: A...

SUSE CVE-2013-6765

OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENTAUTHENTIC, as demonstrated by the ompxmlhandleendelemen...

SUSE CVE-2015-1788

The BNGF2mmodinv function in crypto/bn/bngf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a...

SUSE CVE-2022-3479

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash...

PT-2023-9028 · Unknown +11 · Crypto/Tls +11

Name of the Vulnerable Software and Affected Versions: crypto/tls versions prior to the fixed version Description: The issue is related to large handshake records that may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records, which can cause servers and client...

Denial Of Service (DoS)

nss is vulnerable to Denial Of Service DoS. The vulnerability exists due to the segmentation fault in the client auth in the library, allowing an attacker to cause an application crash through the maliciously crafted input...

RHEL 8 : Red Hat OpenStack Platform 16.2.4 (erlang) (RHSA-2022:8857)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8857 advisory. Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault...

SUSE-SU-2023:0119-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: - CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but the client had no certificates stored bsc1204272. - Updated to version 3.79.3 bsc1207038: - CVE-2022-23491:...

SUSE-SU-2023:0118-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: - CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but the client had no certificates stored bsc1204272. - Updated to version 3.79.3 bsc1207038: - CVE-2022-23491:...

Arbitrary Command Execution

Shardingsphere-proxy is vulnerable to arbitrary code execution. The vulnerability exists because the mysql database backend fails to properly validate client authentication and does not clear out database sessions on time which allows an attacker to execute commands...

erlang/otp: Client Authentication Bypass

A Client Authentication Bypass was found in Erlang/OTP. This issue occurs in certain client-certification situations for SSL, TLS, and DTLS...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (erlang) security update

An update for erlang is now available for Red Hat OpenStack Platform 16.2.4 Train on Red Hat Enterprise Linux RHEL 8.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Updated erlang packages fix security vulnerability

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS. CVE-2022-37026...

MGASA-2022-0450 Updated erlang packages fix security vulnerability

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS. CVE-2022-37026...

Vulnerability fixed in Erlang OTP

Erlang developers have fixed a vulnerability in Erlang OTP. A malicious party could exploit the vulnerability to gain access to sensitive data, when using Erlang SSL in combination with client authentication. Erlang has released updates to fix the vulnerability in OTP 25.1; for more information,...

SUSE SLES15 Security Update : erlang (SUSE-SU-2022:4222-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4222-1 advisory. - CVE-2022-37026: fixed a client authorization bypass vulnerability for SSL, TLS, and DTLS in Erlang/OTP. bsc1205318 Tenable has extracted t...

SUSE SLES15: erlang / erlang-debugger / erlang-debugger-src / erlang-dialyzer / etc (SUSE-SU-2022:4215-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4215-1 advisory. - CVE-2022-37026: fixed a client authorization bypass vulnerability for SSL, TLS, and DTLS in Erlang/OTP. bsc1205318 Tenable h...

Debian dla-3187 : dropbear - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3187 advisory. [email protected] Subject: SECURITY DLA 3187-1 dropbear security update - ----------------------------------------------------------------------- Debian LTS...

DEBIAN-CVE-2022-3786

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate...