Cookie Tossing

Overview Affected versions of this package are vulnerable to Cookie Tossing due to a missing Host- prefix on the gitpodiojwt2 session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JW...

Cookie Tossing

Overview Affected versions of this package are vulnerable to Cookie Tossing due to a missing Host- prefix on the gitpodiojwt2 session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JW...

OESA-2024-1830 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not...

openSUSE Security Advisory (SUSE-SU-2024:2359-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2024:2366-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2024-3596

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature...

SUSE CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

SUSE SLES15: freeradius-server / freeradius-server-devel / freeradius-server-doc / etc (SUSE-SU-2024:2366-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2366-1 advisory. - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414. Tenable has extracted the preceding description...

SUSE SLES15: freeradius-server / freeradius-server-devel / etc (SUSE-SU-2024:2367-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2367-1 advisory. - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414. Tenable has extracted the preceding description block directly...

SUSE SLES15: freeradius-server / freeradius-server-devel / freeradius-server-doc / etc (SUSE-SU-2024:2359-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2359-1 advisory. - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414. Tenable has extracted the preceding description...

SUSE SLES12: freeradius-server / freeradius-server-devel / freeradius-server-doc / etc (SUSE-SU-2024:2361-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2361-1 advisory. - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414. Tenable has extracted the preceding description block directly...

SUSE: Security Advisory (SUSE-SU-2024:2366-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:2361-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:2367-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:2367-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414...

SUSE-SU-2024:2366-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414...

SUSE-SU-2024:2361-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414...

SUSE-SU-2024:2359-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414...

ALPINE-CVE-2024-3596

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature...

DEBIAN-CVE-2024-3596

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature...