SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)

This update for openssl fixes the following issues : CVE-2018-0732: Reject excessively large primes in DH key generation bsc1097158 CVE-2018-0734: Timing vulnerability in DSA signature generation bsc1113652 CVE-2018-0737: Cache timing vulnerability in RSA Key Generation bsc1089039 CVE-2018-5407:...

Moderate: Red Hat Security Advisory: rh-mariadb102-mariadb and rh-mariadb102-galera security and bug fix update

An update for rh-mariadb102-mariadb and rh-mariadb102-galera is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Insufficient Entropy In Key Generation Algorithm

The Network Time Protocol NTP is used to synchronize a computer's time with another referenced time source. It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by...

CRLF Injection

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker...

Arbitrary File Upload

The httpd packages contain the Apache HTTP Server httpd, which is the namesake project of The Apache Software Foundation. Input sanitization flaws were found in the modnegotiation module. A remote attacker able to upload or create files with arbitrary names in a directory that has the MultiViews...

bouncycastle: flaw in the low-level interface to RSA key pair generator

A vulnerability was found in BouncyCastle. The number of iterations of the Miller-Rabin primality test was incorrectly calculated according to FIPS 186-4 C.3. Under some circumstances, this could lead to the generation of weak RSA key pairs...

Security Bulletin: IBM MQ Console is vulnerable to a man in the middle attack (CVE-2018-1925)

Summary The IBM MQ Console is vulnerable to a man in the middle attack caused by weaker than expected cryptographic algorithms. Vulnerability Details CVEID: CVE-2018-1925 DESCRIPTION: IBM MQ uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv...

EulerOS Virtualization 2.5.3 : cyrus-sasl (EulerOS-SA-2019-1173)

According to the version of the cyrus-sasl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt functio...

openssl security and bug fix update

1.0.2k-16.0.1.el76.1 - Bump release for rebuild. 1.0.2k-16.1 - use SHA-256 in FIPS RSA pairwise key check - fix CVE-2018-5407 - EC signature local timing side-channel key extraction...

openssl security update

1.0.2k-16.0.1.el76.1 - Bump release for rebuild. 1.0.2k-16.1 - use SHA-256 in FIPS RSA pairwise key check - fix CVE-2018-5407 - EC signature local timing side-channel key extraction 1.0.2k-16 - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA - fix incorrect error message on...

Security Bulletin: Weaker than expected security in WebSphere Application Server (CVE-2018-1719)

Summary There is a potential for weaker than expected security in WebSphere Application Server which could result in TLS downgrade under certain conditions. This only applies if FIPS is enabled and the keystores/truststores are configured by the JVM property com.ibm.ssl.protocol. Vulnerability...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Personal Communications (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Personal Communications. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit...

Security advisory YSA-2019-02 | Yubico

Who should read this advisory? Customers, IT Managers, or FIPS Crypto Officers who use or manage YubiKey FIPS Series devices. An issue exists in YubiKey FIPS Series devices, versions 4.4.2 and 4.4.4 please note, there is no released firmware version 4.4.3. , where the first set of random values...

Encryption of Federal Data

One of the biggest challenges our customers face when pursuing Federal Risk and Authorization Management Program FedRAMP compliance is the federal mandate that Federal Information Processing Standards FIPS 140-2 validated cryptographic modules must be consistently applied where cryptography is...

openSUSE Security Update : openssl-1_1 (openSUSE-2019-152)

This update for openssl-11 fixes the following issues : Security issues fixed : - The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations bsc1117951 - Fix FIPS RSA generator bsc1118913 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C...

openSUSE: Security Advisory for openssl-1_1 (openSUSE-SU-2019:0152-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for openssl-1_1 (moderate)

openSUSE Security Update: Security update for openssl-11 Announcement ID: openSUSE-SU-2019:0152-1 Rating: moderate References: 1117951 1118913 Cross-References: CVE-2018-0737 Affected Products: openSUSE Leap 15.0 An update that solves one vulnerability and has one errata is now available...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2019:0197-1)

This update for openssl-11 fixes the following issues : Security issues fixed : The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations bsc1117951 Fix FIPS RSA generator bsc1118913 Note that Tenable Network Security has extracted the preceding description block directly from the...

Important: Red Hat Bug Fix Advisory: cockpit bug fix update

Updated cockpit packages that fix two bugs are now available for Red Hat Enterprise Linux 7 Extras. Cockpit is a server administration interface that makes it easy to administer GNU/Linux servers through a web browser. This update fixes two bugs, including this: The cockpit dashboard has been...

SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2018:2452-2)

This update for libgcrypt fixes the following issues : The following security vulnerability was addressed : CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures bsc1097410. The following other issues were fixed: Extended the fipsdrv dsa-sign and dsa-verify...