Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted ...

SUSE SLES12 Security Update : bind (SUSE-SU-2020:1350-1)

This update for bind fixes the following issues : Security issues fixed : CVE-2020-8616: Fixed the insufficient limit on the number of fetches performed when processing referrals bsc1171740. CVE-2020-8617: Fixed a logic error in code which checks TSIG validity bsc1171740. Non-security issue fixed...