CVE-2023-5422

The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSLgetverifyresult function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary securit...

CVE-2023-5422 SSL Certificates are not checked for E-Mail Handling

The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSLgetverifyresult function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary securit...

CVE-2023-5422

CVE-2023-5422 affects OTRS and related editions. The issue arises from using OpenSSL for email transport (POP3/IMAP via SSL/TLS and SMTP) without validating certificates because SSL_get_verify_result() is not used, allowing an attacker to impersonate a trusted host with invalid/expired certificat...

CVE-2023-5422 SSL Certificates are not checked for E-Mail Handling

The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSLgetverifyresult function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary securit...

PT-2023-32094 · Openssl +2 · Openssl +2

Name of the Vulnerable Software and Affected Versions: OTRS versions 7.0.X through 7.0.46 OTRS versions 8.0.X through 8.0.36 OTRS Community Edition versions 6.0.X through 6.0.34 Description: The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static S...

Security Bulletin: IBM Security Verify Access Appliance has multiple security vulnerabilities

Summary There are multiple Security Vulnerabilities that were reported against the IBM Security Verify Access ISVA Appliance. These vulnerabilities have been addressed in the ISVA Appliance. Vulnerability Details CVEID:CVE-2022-4415 DESCRIPTION: systemd could allow a local authenticated attacker ...

CBL Mariner 2.0 Security Update: edk2 / hvloader / nodejs18 / openssl (CVE-2023-0464)

The version of edk2 / hvloader / nodejs18 / openssl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-0464 advisory. - A security vulnerability has been identified in all supported versions of OpenS...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2023-2966)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2023-2992)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2023-2970)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

mariadb:10.5 security update

galera 26.4.14-1 - Rebase to 26.4.14 26.4.13-1 - Rebase to 26.4.13 26.4.12-1 - Rebase to 26.4.12 Judy mariadb 3:10.5.22-1 - Rebase to 10.5.22 3:10.5.21-1 - Rebase to version 10.5.21 3:10.5.20-2 - Use fortifylevel to disable fortification in debug builds 3:10.5.20-1 - Rebase to version 10.5.20...

Tenable SecurityCenter < 6.2.0 Multiple Vulnerabilities (TNS-2023-32)

According to its self-reported version, the Tenable SecurityCenter running on the remote host is prior to 6.2.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-32 advisory. - Security Center leverages third-party software to help provide underlying...

Juniper Junos OS Multiple Vulnerabilities (JSA73176)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA73176 advisory. - AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This...

Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Overview Affected versions of this package are vulnerable to Improper Release of Memory Before Removing Last Reference 'Memory Leak' in the QUIC transport parameters when multiple instances are present or multiple calls to the decode happen. An attacker can cause a denial of service when the MsQu...

[R1] Security Center Version 6.2.0 Fixes Multiple Vulnerabilities

R1 Security Center Version 6.2.0 Fixes Multiple Vulnerabilities Arnie Cabral Tue, 10/10/2023 - 16:56 Security Center leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS resulting in a MsQuic server application or process crash. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other...

Security Bulletin: OpenSSL and OpenSSH for IBM i are vulnerable to arbitrary code execution, denial of service, and security restrictions bypass due to multiple vulnerabilities.

Summary OpenSSH for IBM i is vulnerable to arbitrary code execution due to a flaw in ssh-agent CVE-2023-38408, OpenSSL for IBM i is vulnerable to a denial of service due to a flaw in DH key check CVE-2023-3817, a denial of service due to using an object to text function CVE-2023-2650, and a...

Security Bulletin: IBM Event Streams is affected by a denial of service due to OpenSSL vulnerabilities

Summary Openssl is used by IBM Event Streams as part of the Operating System CVE-2022-4450, CVE-2023-0216. This is a library that provides secure communication. Vulnerability Details CVEID:CVE-2022-4450 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error relat...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL

Summary IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL CVE-2023-2975. The resolving fix contains node.js 18.17.1 which includes OpenSSL v3.0.10.0+quic1 Vulnerability Details CVEID:CVE-2023-2975 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2023-2922)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...