K000133706: OpenSSL vulnerability CVE-2023-0464

Security Advisory Description A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain th...

Security Bulletin: IBM MQ Appliance affected by multiple OpenSSL vulnerabilities

Summary IBM MQ Appliance has resolved multiple OpenSSL vulnerabilities CVE-2022-4304, CVE-2022-4450, CVE-2023-0215 and CVE-2023-0286. Vulnerability Details CVEID:CVE-2022-4304 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service and loss of confidentiality due to [CVE-2022-4304], [CVE-2023-0215], [CVE-2023-0286]

Summary OpenSSL is provided as part of the base images in IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service and loss of confidentiality. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to [CVE-2022-4450]

Summary OpenSSL is provided as part of the base images in IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerabilities in OpenSSL...

Ubuntu: Security Advisory (USN-6046-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6046-1 openssl-ibmca vulnerabilities

It was discovered that OpenSSL-ibmca incorrectly handled certain RSA decryption. An attacker could possibly use this issue to expose sensitive information...

USN-6046-1: OpenSSL-ibmca vulnerabilities

It was discovered that OpenSSL-ibmca incorrectly handled certain RSA decryption. An attacker could possibly use this issue to expose sensitive information...

PT-2023-36307 · Unknown · Openssl-Ibmca

Name of the Vulnerable Software and Affected Versions: OpenSSL-ibmca affected versions not specified Description: It was discovered that OpenSSL-ibmca incorrectly handled certain RSA decryption, which could allow an attacker to expose sensitive information. Recommendations: At the moment, there i...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : OpenSSL-ibmca vulnerabilities (USN-6046-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6046-1 advisory. It was discovered that OpenSSL-ibmca incorrectly handled certain RSA decryption. An attacker could possibly use this issue to...

SUSE SLES12 Security Update : openssl-ibmca (SUSE-SU-2023:2047-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2047-1 advisory. - Fixed a timing-based side channel attack in RSA in the IBMCA engine openssl-ibmca Tenable has extracted the preceding description block...

SUSE: Security Advisory (SUSE-SU-2023:2047-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 / openSUSE 15 Security Update : openssl-ibmca (SUSE-SU-2023:2046-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2046-1 advisory. Upgraded openssl-ibmca to version 2.4.0 bsc1210058 - Provider: Adjustments for OpenSSL versions 3.1 and 3.2 - Provider: Suppor...

SUSE-SU-2023:2047-1 Security update for openssl-ibmca

This update for openssl-ibmca fixes the following issues: - Fixed a timing-based side channel attack in RSA in the IBMCA engine openssl-ibmca...

SUSE-SU-2023:2046-1 Security update for openssl-ibmca

This update for openssl-ibmca fixes the following issues: Upgraded openssl-ibmca to version 2.4.0 bsc1210058 - Provider: Adjustments for OpenSSL versions 3.1 and 3.2 - Provider: Support RSA blinding - Provider: Constant-time fixes for RSA PKCS1 v1.5 and OAEP padding - Provider: Support 'implicit...

Chinese Hackers Spotted Using Linux Variant of PingPull in Targeted Cyberattacks

The Chinese nation-state group dubbed Alloy Taurus is using a Linux variant of a backdoor called PingPull as well as a new undocumented tool codenamed Sword2033. That's according to findings from Palo Alto Networks Unit 42, which discovered recent malicious cyber activity carried out by the group...

Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime may affect IBM Decision Optimization for IBM Cloud Pak for Data (CVE-2023-21835, CVE-2023-21830, CVE-2023-21843 and CVE-2022-4304)

Summary There are multiple vulnerabilities in IBM® Semeru Runtime Version 11 used by IBM Decision Optimization for IBM Cloud Pak for Data. IBM Decision Optimization for IBM Cloud Pak for Data has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-21835 DESCRIPTION: An unspecified...

openssl: X.400 address type confusion in X.509 GeneralName

A type confusion vulnerability was found in OpenSSL when OpenSSL X.400 addresses processing inside an X.509 GeneralName. When CRL checking is enabled for example, the application sets the X509VFLAGCRLCHECK flag, this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call,...

Important: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Security Bulletin: A security vulnerability has been identified in OpenSSL in IBM® AIX® shipped with IBM PureData System for Operational Analytics ( CVE-2022-1292)

Summary IBM® AIX® is shipped as a component of IBM PureData System for Operational Analytics. Information about the security vulnerability in OpenSSL affecting IBM AIX has been published in a security bulletin CVE-2022-1292. Vulnerability Details CVEID:CVE-2022-1292 DESCRIPTION: OpenSSL could all...

The vulnerabilities of the functions EVP_DigestInit(), EVP_DigestUpdate(), or EVP_DigestFinal() in the OpenSSL cryptographic library that implements the PKCS #7 standard allow a perpetrator to cause a service failure.

The vulnerability of the EVPDigestInit, EVPDigestUpdate, or EVPDigestFinal functions in the PKCS 7 standard implementation of the OpenSSL cryptographic library is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure...