5156 matches found
Updated hostapd & wpa_supplicant packages fix security vulnerability
The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an "SSID Confusion" issue. This occurs because the SSID is not always used to derive th...
SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2024:3510-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3510-1 advisory. - CVE-2024-38286: OutOfMemory exception triggered through abuse of the TLS handshake process. bsc1230986 Tenable has extracted the preceding...
Security update for tomcat
This update for tomcat fixes the following issues: CVE-2024-38286: OutOfMemory exception triggered through abuse of the TLS handshake process. bsc1230986 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2024:3510-1 Security update for tomcat
This update for tomcat fixes the following issues: - CVE-2024-38286: OutOfMemory exception triggered through abuse of the TLS handshake process. bsc1230986...
Apache Tomcat improper handling of TLS handshake process data
Overview Apache Tomcat provided by The Apache Software Foundation improperly handles TLS handshake process data, which may lead to a denial-of-service DoS condition CWE-770, CVE-2024-38286. The reporter, Ozaki of North Grid Corporation, reported this issue directly to and coordinated with the...
JVN#72148744: Apache Tomcat improper handling of TLS handshake process data
Apache Tomcat provided by The Apache Software Foundation improperly handles TLS handshake process data, which may lead to a denial-of-service DoS condition CWE-770, CVE-2024-38286. Impact Denial-of-service DoS attacks may be conducted through TLS connection. Solution Update the software Update...
Updated python3 packages fix security vulnerabilities
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “certstorestats” and “getcacerts”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as durin...
SUSE CVE-2024-38286
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be...
CVE-2024-38286
A vulnerability was found in Tomcat. Under certain configurations on any platform, this flaw allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Ha...
EulerOS 2.0 SP8 : python2 (EulerOS-SA-2024-2484)
According to the versions of the python2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects serve...
Apache Tomcat DoS Vulnerability (Sep 2024) - Linux
Apache Tomcat is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"; ...
Apache Tomcat 安全漏洞
Apache Tomcat is a lightweight Web application server from the American Apache Apache Foundation. It is used to implement support for Servlets and JavaServer Page JSP. A security vulnerability exists in Apache Tomcat that stems from allowing an attacker to cause an out-of-memory error by abusing...
Apache Tomcat DoS Vulnerability (Sep 2024) - Windows
Apache Tomcat is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"; ...
SUSE CVE-2023-52424
The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an "SSID Confusion" issue. This occurs because the SSID is not always used to derive th...
QUIC Service Detection
Nessus was able to detect that the remote service supports QUIC by sending a QUIC initial packet and receiving QUIC handshake messages in reply. TRUSTED...
NewStart CGSL MAIN 6.02 : python3 Vulnerability (NS-SA-2024-0053)
The remote NewStart CGSL host, running version MAIN 6.02, has python3 packages installed that are affected by a vulnerability: - Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client...
Security Bulletin: Vulnerability in Golang Go affects watsonx.data
Summary Golang Go could allow a remote attacker to observe TLS handshakes information to correlate successive connections due to an issue with session tickets generated by crypto/tls. This may affect wastonx.data. Vulnerability Details CVEID:CVE-2022-30629 DESCRIPTION: Golang Go could allow a...
CVE-2024-7346
Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to b...
PT-2024-38279 · Progress · Openedge
Name of the Vulnerable Software and Affected Versions: OpenEdge affected versions not specified Description: The issue concerns the bypassing of host name validation for TLS certificates when using the installed OpenEdge default certificates to perform the TLS handshake for a networked connection...