Updated openssl packages fix security vulnerabilities

The updated packages fix security vulnerabilities: ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value IV should be 96 bits 12 bytes. OpenSSL allows a variable nonce length and front pads the nonce with 0...

Fedora Update for mingw-libidn2 FEDORA-2019-28d3cd20c0

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 31 Update: mingw-libidn2-2.3.0-1.fc31

Libidn2 is an implementation of the IDNA2008 specifications in RFC 5890, 5891, 5892 and 5893 for internationalized domain names IDN. It is a standalone library, without any dependency on libidn...

[SECURITY] Fedora 30 Update: rsyslog-8.1911.0-1.fc30

Rsyslog is an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is compatible with stock sysklogd and can be used as a drop-in replacement. Rsyslog is simple to set up,...

October 8, 2019—KB4519990 (Security-only update)

None None...

[SECURITY] Fedora 29 Update: mingw-libidn2-2.2.0-1.fc29

Libidn2 is an implementation of the IDNA2008 specifications in RFC 5890, 5891, 5892 and 5893 for internationalized domain names IDN. It is a standalone library, without any dependency on libidn...

Fedora Update for mingw-libidn2 FEDORA-2019-a8d35fcf7c

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

HTTP Desync Attacks in the Wild and How to Defend Against Them

Inspired by an article by Watchfire from 2005, we recently explored an old attack technique named HTTP Request Smuggling and checked it against our WAF protection. By coincidence, it turned out someone else was also exploring this technique at the same time. Given the hype it received as a result...

RUSTSEC-2019-0029 ChaCha20 counter overflow can expose repetitions in the keystream

The ChaCha20 stream cipher can produce a maximum of 2^32 blocks 256GB before the 32-bit counter overflows. Releases of the chacha20 crate prior to v0.2.3 allow generating keystreams larger than this, including seeking past the limit. When this occurs, the keystream is duplicated, with failure mod...

curl: curl successfully matches IP address literal in URL against IP address literal in certificate Common Name

Summary: A user may invoke the curl command line utility with an IP address literal in the URL, such as https://192.168.124.2/... If the HTTPS server presents a certificate whose Common Name matches this IP address literal as a string that is, Common Name is the ASCII string 192.168.124.2, then...

[SECURITY] Fedora 29 Update: opendmarc-1.3.2-1.fc29

OpenDMARC Domain-based Message Authentication, Reporting & Conformance provides an open source library that implements the DMARC verification service plus a milter-based filter application that can plug in to any milter-aware MTA, including sendmail, Postfix, or any other MTA that suppor ts the...

CVE-2019-14844

A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC...

CVE-2019-14844

A flaw was found in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC...

Design/Logic Flaw

On versions 14.0.0-14.1.2, 13.0.0-13.1.3, 12.1.0-12.1.5, and 11.5.1-11.6.5, the BIG-IP system fails to perform Martian Address Filtering As defined in RFC 1812 section 5.3.7 on the control plane management interface. This may allow attackers on an adjacent system to force BIG-IP into processing...

CVE-2019-6654

The CVE-2019-6654 issue affects BIG-IP on the control plane (management interface): versions 14.0.0–14.1.2, 13.0.0–13.1.3, 12.1.0–12.1.5, and 11.5.1–11.6.5 fail to perform Martian Address Filtering (RFC 1812, section 5.3.7). This may allow attackers on an adjacent network to force BIG-IP into pro...

F5 Networks BIG-IP : Martian address filtering vulnerability (K45644893)

The BIG-IP system fails to perform martian address filtering as defined in RFC 1812, section 5.3.7 for control plane tasks on the management interface. This may allow attackers on an adjacent system to force the BIG-IP system into processing packets with spoofed source addresses. CVE-2019-6654 No...

EulerOS Virtualization for ARM 64 3.0.2.0 : openldap (EulerOS-SA-2019-1939)

According to the version of the openldap packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN databas...

EulerOS 2.0 SP5 : openssl110h (EulerOS-SA-2019-1890)

According to the versions of the openssl110h packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce...

CVE-2019-0365

CVE-2019-0365 affects SAP Kernel components (RFC) including KRNL32NUC, KRNL32UC, KRNL64NUC, KRNL64UC and KERNEL, as well as SAP GUI for Windows (BC-FES-GUI) and SAP GUI for Java (BC-FES-JAV). Versions affected are before 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, and 7.76 for KRNL32NUC, KRNL32UC, ...

DEBIAN-CVE-2019-16159

BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdow...