RLSA-2022:5313 Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: OAUTH2 bearer bypass in connection re-use CVE-2022-22576 curl: credential leak on redirect CVE-2022-27774 curl:...

Archiving Job Fails With: "Failed to provision a proxy appliance : Unable to connect by SSH to Appliance."

Challenge An Archiving Job for a Scale-Out Backup Repository fails with the error: Failed to provision a proxy appliance: Unable to connect by SSH to Appliance. Copy Log Example dd.mm.yyyy hh:mm:ss Warning Failed to provision a proxy appliance: Unable to connect by SSH to appliance. dd.mm.yyyy...

CVE-2022-29245 Weak private key generation in SSH.NET

SSH.NET is a Secure Shell SSH library for .NET. In versions 2020.0.0 and 2020.0.1, during an X25519 key exchange, the client’s private key is generated with System.Random. System.Random is not a cryptographically secure random number generator, it must therefore not be used for cryptographic...

MGASA-2022-0185 Updated curl packages fix security vulnerability

CERTINFO never-ending busy-loop. CVE-2022-27781 TLS and SSH connection too eager reuse. CVE-2022-27782...

CURL-CVE-2022-27782 TLS and SSH connection too eager reuse

libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several TLS and...

Interact with Established SSH Connection

Interacts with a shell on an established SSH connection Module Options msf use payload/generic/ssh/interact msf payloadinteract show actions ...actions... msf payloadinteract set ACTION msf payloadinteract show options ...show and set options... msf payloadinteract run This module requires...

CVE-2021-20989

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be...

Code injection

GateOne allows remote attackers to execute arbitrary commands via shell metacharacters in the port field when attempting an SSH connection...

CVE-2020-20184

GateOne allows remote attackers to execute arbitrary commands via shell metacharacters in the port field when attempting an SSH connection...

Liftoff GateOne 输入验证错误漏洞

Liftoff GateOne is a terminal emulator and SSH client based on an HTML5 implementation. An arbitrary command execution vulnerability exists in Liftoff GateOne. A remote attacker can exploit this vulnerability to execute arbitrary commands via shell metacharacters in the port field when attempting...

GaussDB Kernel: Checking the OPRADMIN Permission

A role with the OPRADMIN permission can use Roach to perform backup and restoration. To avoid arbitrary database file backup, delete roles that do not require the OPRADMIN permission. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and...

GaussDB Kernel: Configuring the Maximum Number of Audit Log Files

The parameter auditfileremainthreshold specifies the maximum number of audit log files. When the total number of audit log files exceeds the specified value, the system writes the warning information to the database logs, deletes the earliest audit log files, and records the deletion to the audit...

GaussDB Kernel: Limiting Connections to the Database

To control the number of sessions that access the database, the number of sessions connected to the database must be limited, preferably within 1024. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

GaussDB Kernel: Checking the Administrator Whose ID Is 10

The system administrator with the ID 10 has the highest database permissions, that is, has all system and object permissions. It is recommended that this user be used only for DBA management instead of service applications. Carefully check the operation records of this system administrator...

openGauss: Configuring the Maximum Logging Duration of a Log File

The parameter logrotationage specifies the maximum logging duration of a log file. After the time expires, another log file is automatically created. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Memory corruption

On Juniper Networks Junos OS devices, a specific SNMP OID poll causes a memory leak which over time leads to a kernel crash vmcore. Prior to the kernel crash other processes might be impacted, such as failure to establish SSH connection to the device. The administrator can monitor the output of t...

CVE-2020-1683 Junos OS: Memory leak leads to kernel crash (vmcore) due to SNMP polling

On Juniper Networks Junos OS devices, a specific SNMP OID poll causes a memory leak which over time leads to a kernel crash vmcore. Prior to the kernel crash other processes might be impacted, such as failure to establish SSH connection to the device. The administrator can monitor the output of t...

CVE-2020-3442

The DuoConnect client enables users to establish SSH connections to hosts protected by a DNG instance. When a user initiates an SSH connection to a DNG-protected host for the first time using DuoConnect, the user’s browser is opened to a login screen in order to complete authentication determined...

Cisco 7937G Denial-of-Service Attack

This module exploits a bug in how the conference station handles incoming SSH connections that provide an incompatible key exchange. By connecting with an incompatible key exchange, the device becomes nonresponsive until it is manually power cycled. Module Options msf use...

ZSQL: Password Grace Period

The password grace period is the days between password expiration warning and password expiration. In this grace period, users can change their passwords before password expiration, ensuring service continuity. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted fr...