Security Bulletin: Multiple Vulnerabilities Affect IBM Secure Proxy

Summary There are multiple vulnerabilities in IBM Secure Proxy. IBM Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-29723 DESCRIPTION: IBM Sterling Secure Proxy uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly...

openssl buffer overflow vulnerability (CNVD-2021-71263)

OpenSSL is an open source general-purpose cryptographic library from the Openssl team capable of implementing the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. The product supports a variety of encryption algorithms, including symmetric ciphers, hashing algorithms,...

GHSA-5Q2R-92F9-4M49 Improper verification of signature threshold in tough

Impact The tough library, prior to 0.7.1, does not properly verify the uniqueness of keys in the signatures provided to meet the threshold of cryptographic signatures. It allows someone with access to a valid signing key to create multiple valid signatures in order to circumvent TUF requiring a...

Improper verification of signature threshold in tough

Impact The tough library, prior to 0.7.1, does not properly verify the uniqueness of keys in the signatures provided to meet the threshold of cryptographic signatures. It allows someone with access to a valid signing key to create multiple valid signatures in order to circumvent TUF requiring a...

aho-corasick (>=0.6.7, <=0.6.10), aigc_secp256k1zkp (0.7.12) +131 more potentially affected by CVE-2020-25576 via rand_core (>=0.1.0, <=0.2.2)

randcore CARGO version =0.1.0, =0.6.7, =0.7.0, =0.7.1, =1.0.0, =2.0.1, =1.0.0, =1.2.5, =0.4.0, =0.1.0, =0.3.0 and more Source cves: CVE-2020-25576 Source advisory: OSV:GHSA-MMC9-PWM7-QJ5W...

artillery-core (>=0.1.2-alpha.3, <=0.1.2), bastion (>=0.3.5, <=0.4.5) +493 more potentially affected by CVE-2021-38195 via libsecp256k1 (>=0.1.3, <=0.3.5)

libsecp256k1 CARGO version =0.1.3, =0.1.2-alpha.3, =0.3.5, =0.1.0, =0.1.1, =0.7.0, =0.1.0, =0.2.0, =1.0.0, =0.5.0, =0.8.2 and more Source cves: CVE-2021-38195 Source advisory: OSV:GHSA-G4VJ-X7V9-H82M...

GHSA-VQX7-PW4R-29RR Out of bounds read in bumpalo

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...

Out of bounds read in bumpalo

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...

CVE-2021-33885

An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of...

CVE-2021-33885

An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of...

CVE-2021-33885

An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of...

Design/Logic Flaw

An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of...

CVE-2021-33885

An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of...

CVE-2021-33885

CVE-2021-33885 is a vulnerability in B. Braun SpaceCom2 before 012U000062 (CWE-345, Insufficient Verification of Data Authenticity). A remote, unauthenticated attacker can send malicious data that is used in place of correct data, enabling full system command access and execution due to the lack ...

hw: Special Register Buffer Data Sampling (SRBDS)

A new domain bypass transient execution attack known as Special Register Buffer Data Sampling SRBDS has been found. This flaw allows data values from special internal registers to be leaked by an attacker able to execute code on any core of the CPU. An unprivileged, local attacker can use this fl...

JetBrains TeamCity Encryption Issue Vulnerability

Jetbrains JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains Jetbrains. The tool provides continuous unit testing, code quality analysis and build issue analysis reports. A cryptographic issue vulnerability exists in...

CVE-2021-29704

IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

Information disclosure

IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2021-29704

CVE-2021-29704 affects IBM Security SOAR (Resilient) on-premises, stemming from use of weaker-than-expected cryptographic algorithms that could lead to information disclosure. The IBM Security SOAR/Resilient DR system allows TLS 1.0 connections, enabling potential decryption of highly sensitive i...

Security Bulletin: IBM Resilient Disaster Recovery (DR) system allows connections over TLS 1.0 (CVE-2021-29704)

Summary IBM Resilient Disaster Recovery DR system allows connections over TLS 1.0 Vulnerability Details CVEID: CVE-2021-29704 DESCRIPTION: IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base score: 5....