GHSA-3Q49-H8F9-9FR9 Missing TLS certificate verification

Faye uses em-http-request6 and faye-websocket10 in the Ruby version of its client. Those libraries both use the EM::Connectionstarttls1 method in EventMachine2 to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not implement certificate verification by...

Juniper Networks Junos OS Trust Management Issue Vulnerability (CNVD-2020-22959)

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The OS provides a secure programming interface and the Junos SDK. A trust management issue vulnerability exists in Juniper Networks Junos OS, which arises from a default certificate for th...

XenMobile - Moving from LDAP to LDAPS

I am planning to turn on LDAPS on our XenMobile servers in the DMZ. We are being sure to open port 636 from our firewall to allow proper LDAPS traffic to flow. I understand there is one additional step to be performed prior to making the switch. I believe I need to export the root certificate fro...

CVE-2019-5010

A null pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accep...

Exploit for Improper Certificate Validation in Microsoft

PoC exploit for CVE-2020-0601, a vulnerability in the signature verification of certificates using elliptic curve cryptography ECC in Windows 10. The exploit targets the MicrosoftECCProductRootCertificateAuthority.cer, a trusted root certificate authority CA using ECC. The vulnerability allows an...

CVE-2019-19696

A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to...

Inspecting TLS Web Traffic - Part 3

In the second part of this blog, I covered how HTTPS web content inspection is provided in Akamai's Enterprise Threat Protector ETP service using ETP proxy. In this final blog post I want to provide information about how Akamai generates, distributes and controls access to private keys including...

JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle...

Scientific Linux Security Update : jss on SL7.x x86_64 (20191016)

Security Fixes : - JSS: OCSP policy 'Leaf and Chain' implicitly trusts the root certificate CVE-2019-14823 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section. C...

JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle...

DEBIAN-CVE-2019-14823

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attack...

CVE-2019-14823

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attack...

PT-2019-13851 · Jss +3 · Cryptomanager +3

Name of the Vulnerable Software and Affected Versions: JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0 Description: A flaw was found in the "Leaf and Chain" OCSP policy implementation where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may...

Google, Mozilla, Apple Block Kazakhstan's Root CA Certificate to Prevent Spying

In a move to protect its users based in Kazakhstan from government surveillance, Google, Apple and Mozilla finally today came forward and blocked Kazakhstan's government-issued root CA certificate within their respective web browsing software. Starting today, Chrome, Safari and Firefox users in...

Google, Mozilla, Apple Block Kazakhstan's Root CA Certificate to Prevent Spying

In a move to protect its users based in Kazakhstan from government surveillance, Google, Apple and Mozilla finally today came forward and blocked Kazakhstan's government-issued root CA certificate within their respective web browsing software. Starting today, Chrome, Safari and Firefox users in...

W13Scan - Passive Security Scanner

W13scan is a proxy-based web scanner that runs on Linux/Windows/Mac systems. Begin Demo Pure Python and Python version = 3 Can you use star to encourage the author ？ Install pip3 install w13scan Usage help w13scan -h running w13scan -s 127.0.0.1:7778 HTTPS Support If you want w13scan to support...

New Android Spyware Created by Russian Defense Contractor Found in the Wild

Cybersecurity researchers have uncovered a new piece of mobile surveillance malware believed to be developed by a Russian defense contractor that has been sanctioned for interfering with the 2016 U.S. presidential election. DubbedMonokle , the mobile remote-access trojan has been actively targeti...

Kazakhstan Begins Intercepting HTTPS Internet Traffic Of All Citizens Forcefully

If you are in Kazakhstan and unable to access the Internet service without installing a certificate, you're not alone. The Kazakhstan government has once again issued an advisory to all major local Internet Service Providers ISPs asking them to make it mandatory for all their customers to install...

Kazakhstan Begins Intercepting HTTPS Internet Traffic Of All Citizens Forcefully

If you are in Kazakhstan and unable to access the Internet service without installing a certificate, you're not alone. The Kazakhstan government has once again issued an advisory to all major local Internet Service Providers ISPs asking them to make it mandatory for all their customers to install...

PT-2019-12825 · Hybrid · Gobot

Name of the Vulnerable Software and Affected Versions: Hybrid Group Gobot versions prior to 1.13.0 Description: The issue concerns the mqtt subsystem skipping verification of root CA certificates by default, allowing an attacker who can perform a man-in-the-middle MITM attack to read or forge...