Authentication flaw

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail...

CVE-2022-26394 Unauthenticated network reconfiguration via TCP/UDP

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail...

PT-2022-17826 · Baxter · Baxter Spectrum Wbm

Name of the Vulnerable Software and Affected Versions: Baxter Spectrum WBM affected versions not specified Description: The issue concerns a lack of mutual authentication with the gateway server host. This could allow an attacker to perform a man-in-the-middle attack, modifying parameters to caus...

CVE-2022-26394

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail...

GHSA-2CPX-6PQP-WF35 fs2-io skips mTLS client verification

Impact When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely...

PT-2022-20593 · Fs2-Io +1 · Fs2-Io +1

Name of the Vulnerable Software and Affected Versions: fs2-io versions 3.1.0 through 3.2.10 Description: The issue arises when establishing a server-mode TLSSocket using fs2-io on Node.js, where the parameter requestCert = true is ignored, and peer certificate verification is skipped, allowing th...

CVE-2022-32290

The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead o...

This Week in Spring - May 10th, 2022

Hi, Spring fans! Im writing this from - I cant believe I get to say this - abroad! Im in London, UK! Now, this is not particularly noteworthy for those millions who already live here. But I dont live here. Im a visitor! I live in San Francisco. I had to fly here! On a plane! With other people!...

envoy: Incorrect configuration handling allows mTLS session re-use without re-validation

A flaw was found in envoy. When certificate validation settings are changed, incorrect configuration handling allows TLS session reuse without revalidation...

envoy: Incorrect configuration handling allows mTLS session re-use without re-validation

A flaw was found in envoy. When certificate validation settings are changed, incorrect configuration handling allows TLS session reuse without revalidation...

DEBIAN-CVE-2022-26356

Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XENDMOPtrackdirtyvram was named HVMOPtrackdirtyvram before Xen 4.9 is racy with ongoing log dirty hypercalls. A suitably timed call to XENDMOPtrackdirtyvram can enable log dirty whil...

Memory corruption

Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XENDMOPtrackdirtyvram was named HVMOPtrackdirtyvram before Xen 4.9 is racy with ongoing log dirty hypercalls. A suitably timed call to XENDMOPtrackdirtyvram can enable log dirty whil...

Apache Spark Encryption Problem Vulnerability (CNVD-2022-21823)

Apache Spark is a multilingual engine for performing data engineering, data science, and machine learning on a single-node machine or cluster. Apache Spark is vulnerable to an encryption issue that stems from the program's use of a custom mutual authentication protocol that allows fully encrypted...

PYSEC-2022-186

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

PT-2022-10712 · Apache · Apache Spark

Name of the Vulnerable Software and Affected Versions: Apache Spark versions 3.1.2 and earlier Description: Apache Spark supports end-to-end encryption of RPC connections via spark.authenticate and spark.network.crypto.enabled. In affected versions, it uses a bespoke mutual authentication protoco...

Apache Spark 加密问题漏洞

Apache Spark is a multilingual engine for performing data engineering, data science, and machine learning on a single-node machine or cluster. Apache Spark is vulnerable to an encryption issue that stems from the program's use of a custom mutual authentication protocol that allows fully encrypted...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass because a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate. Remediation...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...

DEBIAN-CVE-2022-25640

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate...