Important: openssl

Issue Overview: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. A truncation in the IV can result in non-uniqueness, which could result in loss of...

F5 Networks BIG-IP : OpenSSL vulnerability (K18549143)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.2.1 / 15.0.1.1. It is, therefore, affected by a vulnerability as referenced in the K18549143 advisory. If an application encounters a fatal protocol error and then calls SSLshutdown twice once to send a closenotify, a...

F5 Networks BIG-IP : OpenSSL vulnerability (K21462542)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.0.0 / 15.0.0. It is, therefore, affected by a vulnerability as referenced in the K21462542 advisory. - While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This...

CLSA-2023-1698949525 openssl: Fix of CVE-2021-3711

CVE-2021-3711: Fix an incorrect buffer size calculation leads to an overflow - Check the plaintext buffer is large enough when decrypting SM2 - Add extended tests for SM2...

Security Bulletin: AIX is vulnerable to sensitive information exposure due to Perl (CVE-2023-31484 and CVE-2023-31486)

Summary UPDATED Nov 2: iFixes are now available for Perl 5.28.1 and 5.34.1. Perl version 5.28.1.7 and higher, and Perl version 5.34.1.4 and higher, have a dependency on OpenSSL 3.0. The iFixes are offered in lieu of updating to OpenSSL 3.0 and Perl 5.28.1.8 and 5.34.1.4. The iFixes may be...

F5 Networks BIG-IP : OpenSSL vulnerability (K08044291)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.0.2 / 15.0.0. It is, therefore, affected by a vulnerability as referenced in the K08044291 advisory. - Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stac...

Tenable Nessus Agent < 10.4.1 Multiple Vulnerabilities (TNS-2023-24)

Tenable Nessus Agent is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessusagent";...

Tenable Network Security Nessus Security Vulnerability

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security, USA. A security vulnerability exists in Tenable Network Security Nessus versions prior to 10.6.2, which stems from a third-party component OpenSSL, zlib inclusion vulnerability that allow...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2023-3109)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2023-3089)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Puppet Agent 6.x < 6.22.1 / 7.x < 7.6.1 Vulnerability

On February 16, 2021, OpenSSL published security updates addressing CVE-2021-23841, CVE-2021-23839, and CVE-2021-23840. Previous releases of Puppet Agent contain a vulnerable version of OpenSSL. For more information about this vulnerability, refer to the OpenSSL security announcement. Note that...

Tenable Nessus < 10.6.2 Multiple Vulnerabilities (TNS-2023-37)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-37 advisory. - Nessus leverages third-party software to help provide underlying functionality...

Puppet Enterprise < 2019.8.6 / 2021.1.0 Multiple OpenSSL Vulnerabilities

The openssl software which exists in puppet enterprise prior to 2019.8.6 has multiple vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2023-3103)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Tenable Nessus < 10.5.6 Multiple Vulnerabilities (TNS-2023-36)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-36 advisory. - Nessus leverages third-party software to help provide underlying functionality...

Puppet Agent 6.x < 6.22.1 / 7.x < 7.6.1. Vulnerability

On March 25, 2021, OpenSSL published security updates addressing CVE-2021-3450 and CVE-2021-3449. Previous releases of Puppet Agent contain a vulnerable version of OpenSSL. For more information about this vulnerability, refer to the OpenSSL security announcement:...

Tenable Nessus Agent 10.4.2 Multiple Vulnerabilities (TNS-2023-38)

According to its self-reported version, the Tenable Nessus Agent running on the remote host is 10.4.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-38 advisory. - Nessus Agent leverages third-party software to help provide underlying functionality. Several ...

Puppet Agent < 7.1.0 Vulnerability

Puppet Agent prior to 7.1.0 contain a vulnerable version of OpenSSL. For more information about this vulnerability, refer to the OpenSSL security announcement for CVE-2020-1971. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

[R1] Nessus Agent Version 10.4.3 Fixes Multiple Vulnerabilities

R1 Nessus Agent Version 10.4.3 Fixes Multiple Vulnerabilities Arnie Cabral Tue, 10/31/2023 - 14:09 Nessus Agent leverages third-party software to help provide underlying functionality. Several of the third-party components OpenSSL, zlib were found to contain vulnerabilities, and updated versions...

[R1] Nessus Version 10.6.2 Fixes Multiple Vulnerabilities

R1 Nessus Version 10.6.2 Fixes Multiple Vulnerabilities Arnie Cabral Tue, 10/31/2023 - 12:35 Nessus leverages third-party software to help provide underlying functionality. Several of the third-party components OpenSSL, zlib were found to contain vulnerabilities, and updated versions have been ma...