BIT-NODE-MIN-2021-3449 NULL pointer deref in signature_algorithms processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signaturealgorithms extension where it was present in the initial ClientHello, but includes a signaturealgorithmscert extension then a NU...

BIT-NODE-MIN-2022-3602 X.509 Email Address 4-byte Buffer Overflow

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate...

BIT-NODE-MIN-2022-3786 X.509 Email Address Variable Length Buffer Overflow

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate...

Short-Lived Certificates Coming to Let’s Encrypt

Starting next year: Our longstanding offering won't fundamentally change next year, but we are going to introduce a new offering that's a big shift from anything we've done before--short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the...

PT-2024-9918

Name of the Vulnerable Software and Affected Versions: Apache Kafka versions 0.10.2.0 through 3.9.0 Description: The issue is related to the incorrect implementation of the Salted Challenge Response Authentication Mechanism SCRAM in Apache Kafka. Specifically, the server does not verify that the...

CBL Mariner 2.0 Security Update: mariadb (CVE-2023-3724)

The version of mariadb installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-3724 advisory. - If a TLS 1.3 client gets neither a PSK pre shared key extension nor a KSE key share extension when connectin...

CBL Mariner 2.0 Security Update: mariadb (CVE-2024-5288)

The version of mariadb installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-5288 advisory. - An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, lead...

quarkus-core: Leak of local configuration properties into Quarkus applications

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been...

TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension

...

Security update for nodejs20

This update for nodejs20 fixes the following issues: CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency bsc1233856 Other fixes: - Updated to 20.18.1: Experimental Network Inspection Support in Node.js Exposes X509VFLAGPARTIALCHAIN to tls.createSecureContext New...

openSUSE 15 Security Update : icinga2 (openSUSE-SU-2024:0372-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0372-1 advisory. Update to 2.13.10: - CVE-2024-49369: Fix TLS certificate validation bypass bsc1233310. Tenable has extracted the preceding description block directly fro...

openSUSE 15 Security Update : icinga2 (openSUSE-SU-2024:0371-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0371-1 advisory. Update to 2.13.10: - CVE-2024-49369: Fix TLS certificate validation bypass bsc1233310. Tenable has extracted the preceding description block directly fro...

[SECURITY] Fedora 41 Update: rust-rustls-0.23.19-1.fc41

Rustls is a modern TLS library written in Rust...

[SECURITY] Fedora 40 Update: rust-rustls-0.23.19-1.fc40

Rustls is a modern TLS library written in Rust...

GHSA-4C49-9FPC-HC3V lxd CA certificate sign check bypass

Summary If a server.ca file is present in LXDDIR at LXD start up, LXD is in "PKI mode". In this mode, only TLS clients that have a CA-signed certificate should be able to authenticate with LXD. We have discovered that if a client that sends a non-CA signed certificate during the TLS handshake, th...

lxd CA certificate sign check bypass

Summary If a server.ca file is present in LXDDIR at LXD start up, LXD is in "PKI mode". In this mode, only TLS clients that have a CA-signed certificate should be able to authenticate with LXD. We have discovered that if a client that sends a non-CA signed certificate during the TLS handshake, th...

lxd has a restricted TLS certificate privilege escalation when in PKI mode

Summary If a server.ca file is present in LXDDIR at LXD start up, LXD is in "PKI mode". In this mode, all clients must have certificates that have been signed by the CA. The LXD configuration option core.trustcacertificates defaults to false. This means that although the client certificate has be...

GHSA-JPMC-7P9C-4RXF lxd has a restricted TLS certificate privilege escalation when in PKI mode

Summary If a server.ca file is present in LXDDIR at LXD start up, LXD is in "PKI mode". In this mode, all clients must have certificates that have been signed by the CA. The LXD configuration option core.trustcacertificates defaults to false. This means that although the client certificate has be...

GO-2024-3313 Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd

Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd...

PVS Server Down In Console After Upgrade to 2402CU1

After upgrading the first PVS Server in the FARM to 2402 CU1 and running the Configuration Wizard the PVS Server appears down in the console. The Configuration Wizard completes with errors. The following is one example found in the AOT logs:...