Security Bulletin: Vulnerabilities have been identified in OpenSSL, Apache HTTP Server and other system libraries shipped with the DS8000 Hardware Management Console (HMC)

Summary IBM DS8900 Management Console is affected by Open Source expat CVE-2022-43680, libxml2 CVE-2022-40303, CVE-2022-40304, dbus CVE-2022-42010, CVE-2022-42011, CVE-2022-42012, httpd CVE-2023-25690, systemd CVE-2022-4415, OpenSSL CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286,...

The vulnerability of the OpenSSL library, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the OpenSSL library is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures using specially created data...

Mageia: Security Advisory (MGASA-2023-0226)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2023-2317)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2023-2337)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : shim (EulerOS-SA-2023-2344)

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain...

EulerOS 2.0 SP9 : openssl (EulerOS-SA-2023-2337)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain...

EulerOS 2.0 SP9 : shim (EulerOS-SA-2023-2324)

According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain...

EulerOS 2.0 SP9 : openssl (EulerOS-SA-2023-2317)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerabilities CVE-2021-23839, CVE-2021-23840, CVE-2021-23841

Summary There are vulnerabilities CVE-2021-23839, CVE-2021-23840, CVE-2021-23841 which affects IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2021-23839 DESCRIPTION: OpenSSL could provide weaker than expected security, caused by incorrect SSLv2 rollback protection that...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2020-1971

Summary There is a vulnerability CVE-2020-1971 which affects IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, ...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2020-1968

Summary There is a vulnerability CVE-2020-1968 which affects IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2022-0778

Summary There is a vulnerability CVE-2022-0778 which affects IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the BNmodsqrt function when parsing certificates. By using a...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2021-4160

Summary There is avulnerability CVE-2021-4160 which affects IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2021-4160 DESCRIPTION: OpenSSL could provide weaker than expected security, caused by a carry propagation flaw in the MIPS32 and MIPS64 squaring procedure. An...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2021-3712

Summary There is a vulnerability CVE-2021-3712 which affects IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2021-3712 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read when processing ASN.1 strings. By...

MGASA-2023-0226 Updated nodejs packages fix security vulnerability

Current nodejs 14 branch in Mageia 8 is end of life and there are no more security updates. This release allows to move to the new nodejs 18 LTS branch and fixes the following CVEs CVE-2023-30581: mainModule.proto Bypass Experimental Policy Mechanism High CVE-2023-30585: Privilege escalation via...

Updated nodejs packages fix security vulnerability

Current nodejs 14 branch in Mageia 8 is end of life and there are no more security updates. This release allows to move to the new nodejs 18 LTS branch and fixes the following CVEs CVE-2023-30581: mainModule.proto Bypass Experimental Policy Mechanism High CVE-2023-30585: Privilege escalation via...

AES-SIV implementation ignores empty associated data entries

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misl...

PT-2023-4553 · Openssl +7 · Openssl +7

Name of the Vulnerable Software and Affected Versions: OpenSSL affected versions not specified Description: The AES-SIV cipher implementation in OpenSSL contains a bug that causes it to ignore empty associated data entries, which are unauthenticated as a consequence. This issue can mislead...

Tenable Nessus Agent < 10.4.1 Multiple Vulnerabilities (TNS-2023-24)

According to its self-reported version, the Tenable Nessus Agent running on the remote host is prior to 10.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-24 advisory. - Nessus Agent leverages third-party software to help provide underlying functionality...