CVE-2016-3702

CVE-2016-3702: Padding oracle flaw in Red Hat CloudForms Management Engine (CFME) 5 enables remote attackers to obtain sensitive cleartext information. Affected component and exact root cause are described as a padding oracle vulnerability; no specific exploit details or remediation are provided ...

PT-2017-8412

Name of the Vulnerable Software and Affected Versions CloudForms Management Engine CFME version 5 Description A padding oracle flaw allows remote attackers to obtain sensitive cleartext information. Recommendations For CloudForms Management Engine CFME version 5, at the moment, there is no...

CVE-2016-3702: Exposure of Sensitive Information to an Unauthorized Actor

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update

CentOS Errata and Security Advisory CESA-2017:0906 An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

PT-2017-4230

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.39 Description The issue is related to the improper handling of an invalid HMAC in authenticated AES-CBC decryption, allowing attackers to conduct a padding oracle attack. This is due to a lack of integrity...

OpenSSH < 7.5

According to its banner, the version of OpenSSH running on the remote host is prior to 7.5. It is, therefore, affected by an information disclosure vulnerability : - An unspecified timing flaw exists in the CBC padding oracle countermeasures, within the ssh and sshd functions, that allows an...

httpd: Padding Oracle in Apache mod_session_crypto

It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...

Code injection

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

CVE-2015-7824

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

CVE-2015-7824

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

CVE-2015-7824

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

CVE-2015-7824

Botan 1.11.x prior to 1.11.22 is vulnerable to a padding-oracle attack that makes it easier for remote attackers to decrypt TLS ciphertext when using TLS CBC ciphersuites. This is a remote/network issue affecting the Botan cryptographic library; exploitation is contingent on using an affected 1.1...

PT-2017-7276

Name of the Vulnerable Software and Affected Versions botan versions 1.11.x through 1.11.21 Description The issue makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites. Recommendations For botan versions 1.11.x through 1.11.21...

CVE-2015-7824: Exposure of Sensitive Information to an Unauthorized Actor

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

Phabricator: Phabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks.

Dear Phabricator bug bounty team, Summary --- Phabricator encrypts data with AES in CBC mode, but does not ensure integrity of the encrypted data. You must authenticate the data, by either using an HMAC or by using an authenticated block cipher mode like GCM. Why does this vulnerability exist? --...

PT-2017-9960

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 1.0.5 Description The issue concerns an integer overflow in CBC-HMAC on 32-bit architectures, potentially leading to authentication bypass for CBC-HMAC encrypted ciphertexts. On 32-bit platforms, an attacker can...

Code injection

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

CVE-2015-4078

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

CVE-2015-4078

CVE-2015-4078 maps to the POODLE-like issue where SSLv3 is supported by Cloudera Navigator 2.2.x (pre-2.2.4) and 2.3.x (pre-2.3.3), enabling a padding-oracle attack to obtain plaintext data. Public references in the connected docs describe SSLv3/POODLE vulnerability details and remediation patter...

PT-2017-6734

Name of the Vulnerable Software and Affected Versions Cloudera Navigator versions 2.2.x through 2.2.3 Cloudera Navigator versions 2.3.x through 2.3.2 Description The issue makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of the POODLE...