EulerOS Virtualization 2.9.0 : shim (EulerOS-SA-2023-2533)

According to the versions of the shim package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to...

FreeBSD : OpenSSL -- Excessive time spent checking DH q parameter value (bad6588e-2fe0-11ee-a0d1-84a93843eb75)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bad6588e-2fe0-11ee-a0d1-84a93843eb75 advisory. - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2023-2468)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2023-2493)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 15: libopenssl-3-devel / libopenssl-3-devel-32bit / libopenssl3 / etc (SUSE-SU-2023:3011-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3011-1 advisory. - CVE-2023-2975: Fixed AES-SIV implementation ignores empty associated data entries bsc1213383. - CVE-2023-3446: Fixed DHcheck excessive time with ov...

openSUSE 15: libopenssl-3-devel / libopenssl-3-devel-32bit / libopenssl3 / etc (SUSE-SU-2023:3013-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3013-1 advisory. - CVE-2023-2975: Fixed AES-SIV implementation ignores empty associated data entries bsc1213383. - CVE-2023-3446: Fixed DHcheck excessive time with ov...

SUSE SLES12: libopenssl-1_0_0-devel / libopenssl-1_0_0-devel-32bit / etc (SUSE-SU-2023:3012-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3012-1 advisory. - CVE-2023-3446: Fixed DHcheck excessive time with over sized modulus bsc1213487. Tenable has extracted the preceding description block...

Security Bulletin: Multiple OpenSSL vulnerabilities affect IBM Safer Payments

Summary OpenSSL is used by IBM Safer Payments as part of all secure network communications. These are addressed. Vulnerability Details CVEID:CVE-2023-0466 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by a flaw in the X509VERIFYPARAMadd0policy function...

SUSE-SU-2023:3013-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2023-2975: Fixed AES-SIV implementation ignores empty associated data entries bsc1213383. - CVE-2023-3446: Fixed DHcheck excessive time with over sized modulus bsc1213487...

SUSE-SU-2023:3012-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2023-3446: Fixed DHcheck excessive time with over sized modulus bsc1213487...

SUSE-SU-2023:3011-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2023-2975: Fixed AES-SIV implementation ignores empty associated data entries bsc1213383. - CVE-2023-3446: Fixed DHcheck excessive time with over sized modulus bsc1213487...

Zimbra Collaboration Server 8.x < 8.8.15 Patch 41 Multiple Vulnerabilities

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including: - A cross-site scripting XSS vulnerability in the Zimbra Classic Web Client. CVE-2023-37580 - A bug that could lead to exposure of internal JSP and XML files. CVE-2023-387...

EulerOS Virtualization 2.10.1 : openssl (EulerOS-SA-2023-2464)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext...

EulerOS Virtualization 2.10.0 : openssl (EulerOS-SA-2023-2489)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext...

EulerOS Virtualization 2.10.1 : shim (EulerOS-SA-2023-2468)

According to the versions of the shim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were pars...

Zimbra Collaboration Server 9.0.0 < 9.0.0 Patch 34 Multiple Vulnerabilities

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including: - A bug that could lead to exposure of internal JSP and XML files. CVE-2023-38750 - OpenSSL package contains a security issue related to the verification of X.509...

K000135633: OpenSSL vulnerability CVE-2023-2975

Security Advisory Description Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries ...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information exposure in OpenSSL (CVE-2022-4304)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to information exposure in OpenSSL, caused by a timing-based side channel in the RSA Decryption implementation CVE-2022-4304. OpenSSL is included in the Base OS image used by our Speech Services.. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL (CVE-2023-0215)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL, caused by a use-after-free error related to the incorrect handling of streaming ASN.1 data by the BIOnewNDEF function CVE-2023-0215. OpenSSL is included in the Base OS image us...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL (CVE-2022-4450)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL, caused by a double-free error related to the improper handling of specific PEM data by the PEMreadbioex function CVE-2022-4450. OpenSSL is included in the Base OS image used by...