Security Bulletin: Vulnerability in NX-OS Firmware used by IBM c-type SAN directors and switches.

Summary Public disclosed OpenSSL vulnerability in NX-OS Firmware used by IBM c-type SAN directors and switches. The vulnerability has been addressed and can be resolved by applying the NX-OS code level listed below. CVE-2024-0727. Vulnerability Details CVEID:CVE-2024-0727 DESCRIPTION: OpenSSL is...

CBL Mariner 2.0 Security Update: edk2 / hvloader / openssl (CVE-2024-4741)

The version of edk2 / hvloader / openssl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4741 advisory. - Issue summary: Calling the OpenSSL API function SSLfreebuffers May cause memory to be...

Fedora 41 : openssl (2024-7d5c1bcc78)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-7d5c1bcc78 advisory. Fix CVE-2024-5535: SSLselectnextproto buffer overread Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

ALPINE-CVE-2024-4741

Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code...

AlmaLinux 9 : edk2 (ALSA-2024:8935)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:8935 advisory. openssl: Possible denial of service in X.509 name checks CVE-2024-6119 Tenable has extracted the preceding description block directly from the AlmaLinux security...

SUSE SLES15: libopenssl-1_1-devel / libopenssl-1_1-devel-32bit / libopenssl1_1 / etc (SUSE-SU-2024:3904-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3904-1 advisory. - CVE-2023-50782: Implicit rejection in PKCS1 v1.5 bsc1220262 Tenable has extracted the preceding description block directly from the SUSE...

SUSE SLES15: libopenssl-1_1-devel / libopenssl-1_1-devel-32bit / libopenssl1_1 / etc (SUSE-SU-2024:3872-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3872-1 advisory. - CVE-2023-50782: Implicit rejection in PKCS1 v1.5 bsc1220262 Tenable has extracted the preceding description block directly from the SUSE...

Fortinet FortiWeb in OpenSSL library (FG-IR-22-059)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-059 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime...

EulerOS Virtualization 2.12.1 : openssl (EulerOS-SA-2024-2757)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a cra...

Slackware Linux 15.0 openssl Vulnerability (SSA:2024-295-01)

The version of openssl installed on the remote host is prior to 1.1.1zb. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-295-01 advisory. New openssl packages are available for Slackware 15.0 to fix a security issue. Tenable has extracted the preceding description bloc...

AlmaLinux 8 : openssl (ALSA-2024:7848)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:7848 advisory. openssl: SSLselectnextproto buffer overread CVE-2024-5535 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note...

EulerOS 2.0 SP12 : linux-sgx (EulerOS-SA-2024-2535)

According to the versions of the linux-sgx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory...

Use Of Uninitialized Variable

github.com/golang-fips/openssl is vulnerable to Use of Uninitialized Variable. The vulnerability is due to improper handling of uninitialized buffer lengths in FIPS mode, which can result in zeroed buffers being returned. This flaw allows an attacker to force false positive hash matches, send...

ROS-20250203-10

A vulnerability in the SSLselectnextproto function of the OpenSSL TLS and SSL protocols toolkit is related to the information disclosure. Exploitation of the vulnerability allows an attacker acting remotely to gain access to sensitive data and cause a denial of service...

Security Bulletin: Vulnerability in OpenSSL affects IBM Integrated Analytics System [CVE-2022-4450, CVE-2023-0216, CVE-2023-0401, CVE-2022-4203, CVE-2023-0217]

Summary Redhat provided OpenSSL is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE CVE-2022-4450, CVE-2023-0216, CVE-2023-0401, CVE-2022-4203, CVE-2023-0217 Vulnerability Details CVEID:CVE-2022-4450 DESCRIPTION: OpenSSL is vulnerable to a...

OESA-2024-2172 nodejs security update

Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser. Security Fixes: Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to t...

OESA-2024-2175 nodejs security update

Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser. Security Fixes: Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to t...

The vulnerability of the OpenSSL library lies in the possibility of reading an incorrect address in memory during the comparison of the subject name “otherName” with the X.509 certificate. This allows a malicious actor to cause a service failure.

The vulnerability of the OpenSSL library is related to the reading of an incorrect address in memory during the comparison of the subject name “otherName” with the X.509 certificate’s name. Exploiting this vulnerability could allow a malicious actor to cause service failures...

GHSA-H4GH-QQ45-VH27 pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-43.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20240903.txt. If you are...

PT-2024-5929

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.0.15 IBM AIX affected versions not specified Description The issue is related to a denial of service in X.509 name checks. Applications performing certificate name checks, such as TLS clients checking server...