614 matches found
openGauss: Setting the Timeout Period of Client Authentication
authenticationtimeout specifies the maximum time for client authentication. The default value is 1 min. This parameter prevents faulty clients from occupying the connection channel for a long time. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenc...
CVE-2020-5936
On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile...
CVE-2020-5936
On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile...
CVE-2020-5936
On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile...
CVE-2020-5936: Uncontrolled Resource Consumption
On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile...
F5 Networks BIG-IP : BIG-IP Client SSL Security Advisory (K44020030)
The Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile. Impact TMM memory may eventually become exhausted and may result in the system producing a core file. The BIG-IP system may...
CVE-2020-15222
In ORY Fosite the security first OAuth2 & OpenID Connect framework for Go before version 0.31.0, when using "privatekeyjwt" authentication the uniqueness of the jti value is not checked. When using client authentication method "privatekeyjwt", OpenId specification says the following about asserti...
Taking Transport Layer Security (TLS) to the next level with TLS 1.3
Transport Layer Security TLS 1.3 is now enabled by default on Windows 10 Insider Preview builds, starting with Build 20170, the first step in a broader rollout to Windows 10 systems. TLS 1.3 is the latest version of the internet’s most deployed security protocol, which encrypts data to provide a...
Caddy Authorization Issues Vulnerability
Caddy is an open source , cross-platform HTTP/Web server . A security vulnerability exists in Caddy versions prior to 0.10.13 that stems from the program not properly handling TLS client authentication. An attacker can exploit the vulnerability to bypass authentication...
CVE-2018-21246
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...
PT-2020-8890 · Caddy · Caddy
Name of the Vulnerable Software and Affected Versions: Caddy versions prior to 0.10.13 Description: The issue is related to the mishandling of TLS client authentication. This is caused by the lack of the StrictHostMatching mode, allowing an attacker to bypass TLS client authentication. An attacke...
CVE-2018-21246: Improper Authentication
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...
Replay Attack
github.com/ory/hydra is vulnerable to replay attack. During the client authentication using the method privatekeyjwt, Hydra does not check the uniqueness of jti token a unique identifier for the token to prevent the reuse of the token more than one time unless there are conditions for reuse betwe...
CVE-2020-5300
In Hydra an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go, before version 1.4.0+oryOS.17, when using client authentication method 'privatekeyjwt' 1, OpenId specification says the following about assertion jti: "A unique identifier for the token, which can be used to...
Design/Logic Flaw
In Hydra an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go, before version 1.4.0+oryOS.17, when using client authentication method 'privatekeyjwt' 1, OpenId specification says the following about assertion jti: "A unique identifier for the token, which can be used to...
PT-2020-18389 · Ory · Hydra
Name of the Vulnerable Software and Affected Versions: Hydra versions prior to 1.4.0+oryOS.17 Description: The issue concerns Hydra, an OAuth2 Server and OpenID Certified OpenID Connect Provider written in Go. When using the client authentication method 'private key jwt', Hydra does not check the...
nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string
An encoding error flaw exists in the Node.js code that is used to read a peer certificate in the TLS client authentication. An attacker can use this flaw to crash the process used to handle TLS client authentication...
nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string
An encoding error flaw exists in the Node.js code that is used to read a peer certificate in the TLS client authentication. An attacker can use this flaw to crash the process used to handle TLS client authentication...
Elastic Stack 7.5.0 security update
Metricbeat and Filebeat DSA public key panic ESA-2019-15 A denial of service flaw when parsing malformed DSA public keys was discovered in Go, the language used to implement Beats. If Metricbeat or Filebeat are configured to accept incoming TLS connections with client authentication enabled, a...
IBM Cloud Pak System Client Authentication Vulnerability
IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. A security vulnerability exists in IBM Cloud Pak System version V2.3.0. An...