107 matches found
USN-4607-2 openjdk-8, openjdk-lts regressions
USN-4607-1 fixed vulnerabilities and added features in OpenJDK. Unfortunately, that update introduced a regression that could cause TLS connections with client certificate authentication to fail in some situations. This update fixes the problem. We apologize for the inconvenience. Original adviso...
CVE-2020-15136
A flaw was found in etcd. The gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No...
Missing Authentication
github.com/etcd-io/etcd does not perform TLS authentication. When starting a gateway for endpoints provided in the --endpoints flag, it does not handle the endpoints validation...
etcd < 3.3.23, 3.4.x < 3.4.10 Multiple Vulnerabilities
etcd is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:etcd:etcd"; if description...
CVE-2020-15136
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints...
CVE-2020-15136
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints...
CVE-2020-15136
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints...
CVE-2020-15136
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints...
CVE-2020-15136 Improper authentication in etcd
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints...
CVE-2020-15136
CVE-2020-15136 affects etcd gateway behavior: TLS authentication is applied only to endpoints discovered via DNS SRV for a domain, with no authentication for endpoints provided via the --endpoints flag. Root cause is limited endpoint validation in the gateway’s discoverEndpoints flow. Impact: pot...
CVE-2020-4060
In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message https://doc.sm.tc/station/cupsproto.htmlhttp-post-response where the signature length is larger than ...
Design/Logic Flaw
In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message https://doc.sm.tc/station/cupsproto.htmlhttp-post-response where the signature length is larger than ...
CVE-2020-4060
LoRa Basics Station CVE-2020-4060: A Use-After-Free in cups_update_info affects versions prior to 2.0.4 on 32-bit platforms. If the CUPS server responds with a signature length > 2 GB (or sets a length field > 2^31-1 while not containing that much data), the code path frees memory and then ...
CVE-2020-4060 Use After Free in in cups_update_info in LoRa Basics Station
In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug is triggered on 32-bit machines when the CUPS server responds with a message https://doc.sm.tc/station/cupsproto.htmlhttp-post-response where the signature length is larger than ...
Authentication Bypass
github.com/caddyserver/caddy is vulnerable to authentication bypass. When TLS is used for client authentication, it does not enforce a tls: StrictHostMatching mode for client authentication, leading to a bypass of TLS authentication...
CVE-2018-21246
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...
CVE-2018-21246
Caddy before 0.10.13 mishandles TLS client authentication due to missing StrictHostMatching, enabling an authentication bypass. Affected product: Caddy web server; vulnerability in TLS client auth handling (authentication bypass). CVE-2018-21246 is documented in multiple sources (GHSA, OSV, NVD, ...
CVE-2020-13777
A flaw was found in GnuTLS, in versions starting from 3.6.4, where it does not session the ticket encryption key in a secure fashion by the application which is connecting. This flaw allows an attacker to craft a man-in-the-middle-attack, with the ability to bypass the TLS1.3 authentication and...
F5 NGINX Controller Trust Management Issue Vulnerability
F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller versions prior to 3.2.0, which stems from the fact that by...
MGASA-2019-0385 Updated proftpd packages fix security vulnerability
An issue was discovered in tlsverifycrl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL skX509REVOKEDvalue function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the...