openSUSE: Security Advisory for ruby2.5 (openSUSE-SU-2021:0471-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Oracle Linux 7 : squid (ELSA-2021-1135)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1135 advisory. 7:3.5.20-17.6 - Resolves: 1944256 - CVE-2020-25097 squid: improper input validation may allow a trusted client to perform HTTP Request Smuggling Tenable has...

squid security update

7:3.5.20-17.6 - Resolves: 1944256 - CVE-2020-25097 squid: improper input validation may allow a trusted client to perform HTTP Request Smuggling...

Important: Red Hat Security Advisory: squid security update

An update for squid is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

RHEL 7 : squid (RHSA-2021:1135)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1135 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: improper inpu...

Debian: Security Advisory (DSA-4885-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM API Connect is impacted by vulnerabilities in Node.js and OpenSSL (CVE-2020-1971, CVE-2020-8265, CVE-2020-8287)

Summary IBM API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker could exploit this...

The vulnerability in the uri_whitespace configuration implementation of the Squid proxy server allows a hacker to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the uriwhitespace configuration in the Squid proxy server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely. This constitutes an HTTP Request Smuggling attack...

Debian DSA-4885-1 : netty - security update

Multiple security issues were discovered in Netty, a Java NIO client/server framework, which could result in HTTP request smuggling, denial of service or information disclosure. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

[SECURITY] [DSA 4885-1] netty security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4885-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 05, 2021 https://www.debian.org/security/faq -...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM InfoSphere Information Server

Summary Muiltiple vulnerabilities in Node.js that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID: CVE-2021-22884 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an error when the allowlist includes "localhost6". By controlling the...

Low: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Ubuntu: Security Advisory (USN-4895-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak for Automation

Summary The vulnerabilities are related to Node.js runtime and to other component specific vulnerabilities. Vulnerability Details CVEID: CVE-2020-8265 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by a use-after-free in TLSWrap within the TLS implementation. By writing to a TL...

USN-4895-1: Squid vulnerabilities

Alex Rousskov and Amit Klein discovered that Squid incorrectly handled certain Content-Length headers. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. This issue only affected Ubuntu 20.04 LTS. CVE-2020-15049 Jianjun Chen...

OESA-2021-1092 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a...

Debian DSA-4873-1 : squid - security update

Jianjun Chen discovered that the Squid proxy caching server was susceptible to HTTP request smuggling. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4873. The text itself is copyright C Software in the Publ...

openSUSE Security Update : ruby2.5 (openSUSE-2021-471)

This update for ruby2.5 fixes the following issues : - CVE-2020-25613: Fixed a potential HTTP Request Smuggling in WEBrick bsc1177125. - Enable optimizations also on ARM64 bsc1177222 This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The...

SUSE SLED15 / SLES15 Security Update : ruby2.5 (SUSE-SU-2021:0933-1)

This update for ruby2.5 fixes the following issues : CVE-2020-25613: Fixed a potential HTTP Request Smuggling in WEBrick bsc1177125. Enable optimizations also on ARM64 bsc1177222 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

Security Bulletin: Multiple vulnerabilities in node.js may affect configuration editor used in IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-1971, CVE-2020-8265, CVE-2020-8287

Summary Security vulnerabilities have been reported for Node.js. IBM Business Automation Workflow and IBM BPM include a stand-alone tool for editing configuration properties files that is based on IBM SDK for Node.js. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable t...