CVE-2023-20209

Cisco Expressway를 조사하기 시작한 이유는 레드팀 공개 평가Red Team engagements 중 인터넷에서 꽤 많은 인스턴스를 발견했지만, 업무 중에 이 제품을 더 자세히 탐구할 시간이 없었기 때문입니다. 처음에는 인증 우회auth bypass를 찾아 RCE로 연결하려 했지만 시간이 부족해 인증 후 RCEpost auth RCE로 타협했습니다. 프론트엔드 PHP 코드는 추가 익스플로잇에 유망해 보입니다... 이는 CVE-2023-20209의 발견 및 공급업체 통지 과정에서 작성한 노트입니다. 익스플로잇 후 프로...

DEBIAN-CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

CVE-2026-93599

rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly 0x00 zero padding bits and no data bytes, so rawbits.len - 1 underflows on t...

CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

EUVD-2026-82897

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

CVE-2026-93602 rustls-webpki before 0.103.10 CRL Revocation Check Bypass

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

BIT-TOMCAT-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23,...

Astra Linux – Vulnerability in libksba

A vulnerability was discovered in the Libksba library due to an integer overflow within the CRL parser. This vulnerability can be exploited remotely to execute code on the target system by passing specially crafted data to the application, such as a malicious S/MIME attachment...

Astra Linux – Vulnerability in libksba

Before version 1.6.3, Libksba was vulnerable to an integer overflow vulnerability in the CRL signature parser...

Astra Linux – Vulnerability in OpenSSL

There is a type confusion vulnerability related to X.400 address processing within an X.509 GENERALNAME. X.400 addresses are parsed as ASN1STRING, but the public structure definition for GENERALNAME incorrectly specifies the type of the x400Address field as ASN1TYPE. This field is subsequently...

Astra Linux – Vulnerability in StrongSwan

Before version 5.9.8, StrongSwan allowed remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity and intermediate CA certificate that contained a CRL/OCSP URL pointing to a server under the attacker’s control that did not respond properly. In some...

CVE-2026-70667

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

CVE-2026-55162

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crlverify and ocspverify without adequate destination validation. An authenticated operator could subm...

EUVD-2026-61151

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

CVE-2026-55162 Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crlverify and ocspverify without adequate destination validation. An authenticated operator could subm...

CVE-2026-55162

Netflix Lemur versions before 1.9.2 are vulnerable to post-authentication SSRF: lemur/certificates/verify.py passes attacker-controlled CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions directly to requests.get() and openssl ocsp without destination validation, e...

CVE-2026-55162 Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crlverify and ocspverify without adequate destination validation. An authenticated operator could subm...

Unity Linux 20.1070a Security Update: compat-openssl10 (UTSA-2026-099545)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099545 advisory. There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1STRING but the public...

Updated tomcat packages fix security vulnerabilities

The updated packages fix security vulnerabilities: XSS in number guess example. CVE-2026-50229 Bad ornext processing in RewriteValve. CVE-2026-53404 Invalid CRL configuration doesn't trigger failure for FFM Connector. CVE-2026-53434 Logged effective web.xml is incomplete. CVE-2026-55276...

Uncontrolled Recursion

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose nesting-depth...