Security Bulletin: IBM Spectrum Symphony openssl 1.1.1 End of Life

Summary IBM Spectrum Symphony openssl 1.1.1 End of Life Vulnerability Details CVEID:CVE-2022-4304 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of...

Security Bulletin: Multiple vulnerabilities in OpenSSL affects IBM Rational ClearCase

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM Rational ClearCase. CVE-2022-4450, CVE-2022-4304, CVE-2023-0215, CVE-2023-0286 Vulnerability Details CVEID:CVE-2022-4450 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free...

Security Bulletin: Multiple vulnerabilities in OpenSSL affects IBM Rational ClearCase.

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM Rational ClearCase. CVE-2023-0466, CVE-2023-0465, CVE-2023-0464, CVE-2023-2650 Vulnerability Details CVEID:CVE-2023-0466 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions...

Medium: openssl

Issue Overview: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL Node.js (CVE-2023-2650)

Summary IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL Node.js CVE-2023-2650. The resolving fix is included in a Node upgrade to Node =18.16.1, = OpenSSL 3.0.9 Vulnerability Details CVEID:CVE-2023-2650 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caus...

OpenSSL SEoL (3.0.x)

According to its version, OpenSSL is 3.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable,...

ABB RTU500 Series Out-of-bounds Read in embedded OpenSSL (CVE-2021-3712)

A vulnerability exists in the OpenSSL Version 1.0.2 that affects the RTU500 Series product versions listed below. RTU500 series CMU Firmware versions 12.0.1 – 12.0.14 12.2.1 – 12.2.11 12.4.1 – 12.4.11 12.6.1 – 12.6.8 12.7.1 – 12.7.5 13.2.1 – 13.2.5 13.3.1 – 13.3.3 13.4.1 ASN.1 strin...

OpenSSL SEoL (1.1.0.x)

According to its version, OpenSSL is 1.1.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable,...

OpenSSL SEoL (1.1.1.x)

According to its version, OpenSSL is 1.1.1.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable,...

ABB RTU500 and AFS Series OpenSSL Bleichenbacher Style Attack (CVE-2022-4304)

A vulnerability exists in the OpenSSL that affects the RTU500 Series product versions listed below. RTU500 series CMU Firmware versions 12.0.1 – 12.0.15 12.2.1 – 12.2.12 12.4.1 – 12.4.12 12.6.1 – 12.6.9 12.7.1 – 12.7.6 13.2.1 – 13.2.6 13.3.1 – 13.3.3 13.4.2 A timing based side chann...

OpenSSL SEoL (1.0.1.x)

According to its version, OpenSSL is 1.0.1.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable,...

OpenSSL SEoL (1.0.0.x)

According to its version, OpenSSL is 1.0.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable,...

OpenSSL SEoL (1.0.2.x)

According to its version, OpenSSL is 1.0.2.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable,...

OpenSSL SEoL (3.1.x)

According to its version, OpenSSL is 3.1.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable,...

ABB RTU500 Series Buffer Overflow in embedded OpenSSL (CVE-2021-3711)

A vulnerability exists in the OpenSSL Version 1.0.2 that affects the RTU500 Series product versions listed below. RTU500 series CMU Firmware versions 12.0.1 – 12.0.14 12.2.1 – 12.2.11 12.4.1 – 12.4.11 12.6.1 – 12.6.8 12.7.1 – 12.7.5 13.2.1 – 13.2.5 13.3.1 – 13.3.3 13.4.1 In order to...

ABB RTU500 Series, AFS series and M2M Gateway Type Confusion in embedded OpenSSL (CVE-2023-0286)

A vulnerability exists in the OpenSSL that affects the RTU500 Series product versions listed below. RTU500 series CMU Firmware versions 12.0.1 – 12.0.15 12.2.1 – 12.2.12 12.4.1 – 12.4.12 12.6.1 – 12.6.9 12.7.1 – 12.7.6 13.2.1 – 13.2.6 13.3.1 – 13.3.3 13.4.2 M2M Gateway ARM600:...

ABB RTU500 Series Infinite Loop in embedded OpenSSL (CVE-2022-0778)

A vulnerability exists in the OpenSSL version 1.0.2 that affects the RTU500 Series product versions listed below. RTU500 series CMU Firmware versions 12.0.1 – 12.0.14 12.2.1 – 12.2.11 12.4.1 – 12.4.11 12.6.1 – 12.6.8 12.7.1 – 12.7.5 13.2.1 – 13.2.5 13.3.1 – 13.3.3 13.4.1 The BNmodsq...

OpenSSL SEoL (<= 0.9.8.x)

According to its version, OpenSSL is less than or equal to 0.9.8.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.19-openssl (SUSE-SU-2023:3841-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3841-1 advisory. Update to version 1.19.13 bsc1200441. - CVE-2023-29409: Fixed unrestricted RSA keys in...

nodejs:18 security, bug fix, and enhancement update

nodejs 1:18.17.1-1 - Rebase to version 18.17.1 Resolves: rhbz2228939 Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559 - Specify proper OpenSSL configuration section build nodejs-nodemon 3.0.1-1 - Rebase to 3.0.1 - Resolves: CVE-2022-25883 nodejs-packaging...