5160 matches found
python-twisted: SSH client and server denial of service during SSH handshake
An uncontrolled resource consumption flaw was found in python-twisted in the dataReceived function. This flaw allows an unauthenticated, remote attacker to send a simple command to use all available memory and crash the server...
RHEL 8 : Red Hat OpenStack Platform 16.2 (python-twisted) (RHSA-2022:0992)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0992 advisory. Twisted is a networking engine written in Python, supporting numerous protocols. It contains a web server, numerous chat clients, chat...
python-twisted: SSH client and server denial of service during SSH handshake
An uncontrolled resource consumption flaw was found in python-twisted in the dataReceived function. This flaw allows an unauthenticated, remote attacker to send a simple command to use all available memory and crash the server...
Man In The Middle (MitM)
@chainsafe/libp2p-noise is vulnerable to Man In The Middle attack. The vulnerability exists due to a lack of validation of signature during handshake process...
OpenJDK: Non-constant comparison during TLS handshakes (JSSE, 8269618)
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated...
GHSA-J3FF-XP6C-6GCC Failure to validate signature during handshake
Impact @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned. Patches Users should upgrade to 4.1.2 or 5.0.3 Workarounds No workarounds, just patch...
Failure to validate signature during handshake
Impact @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned. Patches Users should upgrade to 4.1.2 or 5.0.3 Workarounds No workarounds, just patch...
Code injection
@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...
CVE-2022-24759 Failure to validate signature during handshake in @chainsafe/libp2p-noise
@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...
CVE-2022-24759 Failure to validate signature during handshake in @chainsafe/libp2p-noise
@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...
CVE-2022-24759 Failure to validate signature during handshake in @chainsafe/libp2p-noise
@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...
Twisted SSH client and server deny of service during SSH handshake.
Impact The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier. A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as...
CVE-2022-25640
In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...
DEBIAN-CVE-2022-25640
In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...
Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2018-0732, CVE-2018-0737)
Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project on April 16, 2018 and June 12, 2018. OpenSSL, used by IBM Spectrum Control formerly Tivoli Storage Productivity Center , has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is...
Uncaught Exception
Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: via the crypto/tls process. An attacker can cause a panic and potentially disrupt service by providing a certificate of an...
CVE-2022-24976
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence...
DEBIAN-CVE-2022-24976
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence...
Atheme IRC Services 授权问题漏洞
Atheme IRC Services is a set of IRC services designed for large IRC networks with high scalability requirements. An authorization issue vulnerability exists in Atheme IRC Services that originates when used with InspIRCd and allows authentication to be bypassed by ending the IRC handshake at some...
