golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey​ and ctx​. That functi...

Security Bulletin: Multiple vulnerabilities in OpenSSL affects IBM DevOps Code ClearCase

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM DevOps Code ClearCase. CVE-2023-6237, CVE-2023-6129, CVE-2023-5678, CVE-2024-0727 Vulnerability Details CVEID:CVE-2023-6237 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2024-1893)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2024-1917)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An...

HPESBHF04603 rev.1 - HPE ProLiant DL/ML/XL, Synergy, Edgeline and Alletra Servers Using OpenSSL, Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS; Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL20 Gen11 -Prior to v1.4803-14-2024 HPE ProLiant DL110 Gen11 -Prior to v2.2005-27-2024 HPE ProLiant DL320 Gen11 Server -Prior to...

RHEL 9 : skopeo (RHSA-2024:4502)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4502 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify file...

CBL Mariner 2.0 Security Update: cloud-hypervisor-cvm / hvloader / nodejs18 (CVE-2023-5363)

The version of cloud-hypervisor-cvm / hvloader / nodejs18 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-5363 advisory. - Issue summary: A bug has been identified in the processing of key and...

PT-2024-40812 · Git +1 · Openssl

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A null-dereference read crash was reported, indicating a potential issue where the software attempts to access a null pointer, leading to a crash. The crash type is specified as a...

PT-2024-40808 · Git +1 · Openssl

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a null-dereference read crash. Technical details about the crash include the functions evp mac final, kbkdf derive, and do evp kd...

skopeo security update

2:1.14.3-3 - golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394...

Cactus Ransomware: New strain in the market

Cactus Ransomware: New strain in the market By Aishwarya Gentyal · July 11, 2024 Ransomware malware has been around for many years now and it continues to dominate the headlines. It's an attacker's top choice for cyber extortion and is one of the most active and profound threats facing...

Security Bulletin: Publicly disclosed vulnerability in OpenSSL affects IBM Netezza Performance Server

Summary OpenSSL is used by IBM Netezza Performance Server. IBM Netezza Performance Server has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a...

Critical Photon OS Security Update - PHSA-2024-5.0-0313

Updates of 'openssl' packages of Photon OS have been released...

The vulnerability of the SSLfree_buffers() function in the OpenSSL cryptographic library allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the SSLfreebuffers function in the OpenSSL cryptographic library is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial-of-service attack...

Critical Photon OS Security Update - PHSA-2024-5.0-91-0313

Updates of 'openssl' packages of Photon OS have been released...

Security Bulletin: IBM QRadar Wincollect is using components with known vulnerabilities

Summary IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities. IBM has addressed the relevant vulnerabilities with updates. Vulnerability Details CVEID:CVE-2024-4067 DESCRIPTION: Node.js micromatch module is vulnerable to a denial of service, caused by a regular...

Security Bulletin: IBM DataPower Gateway vulnerable to DoS due to OpenSSL (CVE-2024-2511)

Summary OpenSSL is used to provide TLS functionality within IBM DataPower Gateway Vulnerability Details CVEID:CVE-2024-2511 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by improper server configuration validation. By using a specially crafted server configuration, a remote...

Important: Red Hat Security Advisory: gvisor-tap-vsock security update

An update for gvisor-tap-vsock is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey​ and ctx​. That functi...

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey​ and ctx​. That functi...