SUSE-SU-2020:3152-1 Security update for apache-commons-httpclient

This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service HTTPS call hang via unspecified vectors...

SUSE-SU-2020:3149-1 Security update for apache-commons-httpclient

This update for apache-commons-httpclient fixes the following issues: - http/conn/ssl/SSLConnectionSocketFactory.java ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service HTTPS call hang via unspecified vectors...

qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails...

squid:4 security, bug fix, and enhancement update

An update is available for libecap. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Squid is a high-performance proxy caching server for web clients, supporting...

openSUSE Security Update : gnutls (openSUSE-2020-1743)

This update for gnutls fixes the following issues : - Fix heap buffer overflow in handshake with norenegotiation alert sent CVE-2020-24659 bsc1176181 - FIPS: Implement ECDH requirements from SP800-56Arev3 bsc1176086 - FIPS: Use 2048 bit prime in DH selftest bsc1176086 - FIPS: Add TLS KDF selftest...

Security update for gnutls (moderate)

openSUSE Security Update: Security update for gnutls Announcement ID: openSUSE-SU-2020:1724-1 Rating: moderate References: 1176086 1176181 1176671 Cross-References: CVE-2020-24659 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has two fixes is now available...

MGASA-2020-0379 Updated gnutls packages fix security vulnerability

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the...

Pexip Infinity Denial of Service Vulnerability (CNVD-2020-59043)

Pexip Infinity is video communications software that organizations can deploy in their IT infrastructure, public or private cloud, or any hybrid combination to enable everyone to have their own personal, high-quality video, audio, and mobile conferencing experience. A denial of service...

CVE-2020-5929

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous ADH or Ephemeral DHE Diffie-Hellman key exchange and Single DH use option not enable...

CVE-2020-5929

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous ADH or Ephemeral DHE Diffie-Hellman key exchange and Single DH use option not enable...

Design/Logic Flaw

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous ADH or Ephemeral DHE Diffie-Hellman key exchange and Single DH use option not enable...

CVE-2020-5929

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous ADH or Ephemeral DHE Diffie-Hellman key exchange and Single DH use option not enable...

CVE-2020-5929

Summary (CVE-2020-5929): BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server using a Client SSL profile, and ADH/DHE key exchange (with Single DH use not enabled) are vulnerable to crafted TLS handshakes that may recover plaintext by exploiting PMS starting with ...

PT-2020-18827 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 11.6.1 through 11.6.2 F5 BIG-IP versions 12.1.0 through 12.1.2 HF1 F5 BIG-IP versions 13.0.0 through 13.0.0 HF2 Description: The issue affects F5 BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, where a...

CVE-2020-3429

A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause denial of service DoS condition on an affected device. The vulnerability is due to incorrect pack...

CVE-2020-3429 Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family WPA Denial of Service Vulnerability

A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause denial of service DoS condition on an affected device. The vulnerability is due to incorrect pack...

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing and then an invalid second handshake occurs. The crash happens in the application's error handling path where the gnutls_deinit function is called after detecting a handshake failure.

...

Exploit for CVE-2020-9992

c0ntextomy an informal fallacy and a type of false attributi...

ZeroMQ: Denial of service

Background Looks like an embeddable networking library but acts like a concurrency framework. Description It was discovered that ZeroMQ does not properly handle connecting peers before a handshake is completed. Impact An unauthenticated remote attacker able to connect to a ZeroMQ endpoint, even...

Vulnerability found in BIG-IP

F5 has found a vulnerability in BIG-IP. The vulnerability enables an unauthenticated remote malicious party to opportunity to decrypt TLS-encrypted messages. The malicious party must perform a rogue TLS handshake to do so. BIG-IP categorizes this vulnerability according to the CVSSv3 method with ...