CVE-2025-38471

In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the que...

UBUNTU-CVE-2025-38471

In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the que...

CVE-2025-38471

CVE-2025-38471 concerns the Linux kernel TLS path. The TLS queue can operate on an old skb after aggressive net-next skb compaction, leading to a slab-use-after-free in tls_strp_check_rcv. The Astra Linux bulletin confirms the fix is to always refresh the queue when reading a socket, instead of r...

CVE-2025-38471

In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the que...

CVE-2025-38471 tls: always refresh the queue when reading sock

In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the que...

CVE-2025-38471 tls: always refresh the queue when reading sock

In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the que...

USN-7674-1: OpenJDK 11 vulnerabilities

It was discovered that the 2D component of OpenJDK 11 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2025-30749, CVE-2025-50106 VMashroor Hasan Bhuiyan discovered that the JSSE...

USN-7673-1: CRaC JDK 21 vulnerabilities

It was discovered that the 2D component of CRaC JDK 21 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2025-30749, CVE-2025-50106 VMashroor Hasan Bhuiyan discovered that the JSSE...

USN-7672-1: CRaC JDK 17 vulnerabilities

It was discovered that the 2D component of CRaC JDK 17 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2025-30749, CVE-2025-50106 VMashroor Hasan Bhuiyan discovered that the JSSE...

Ubuntu 25.04 : OpenJDK 24 vulnerabilities (USN-7669-1)

The remote Ubuntu 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7669-1 advisory. It was discovered that the 2D component of OpenJDK 24 did not properly manage memory under certain circumstances. An attacker could possibly use this issue t...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : OpenJDK 21 vulnerabilities (USN-7668-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7668-1 advisory. It was discovered that the 2D component of OpenJDK 21 did not properly manage memory under certain circumstances. An...

fatt

This is a Python script for extracting network metadata and fingerprints from packet capture files pcap or live network traffic. The script, named "fatt," is designed for monitoring honeypots and other network forensic analysis use cases. It uses the pyshark library, a Python wrapper for tshark,...

CVE-2025-36005

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the...

NewStart CGSL MAIN 7.02 : qt5-qtbase Multiple Vulnerabilities (NS-SA-2025-0204)

The remote NewStart CGSL host, running version MAIN 7.02, has qt5-qtbase packages installed that are affected by multiple vulnerabilities: - An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2...

NewStart CGSL MAIN 7.02 : perl-CPAN Vulnerability (NS-SA-2025-0188)

The remote NewStart CGSL host, running version MAIN 7.02, has perl-CPAN packages installed that are affected by a vulnerability: - CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. CVE-2023-31484 Note that Nessus has not tested for these issues but ha...

NewStart CGSL MAIN 7.02 : perl-HTTP-Tiny Vulnerability (NS-SA-2025-0177)

The remote NewStart CGSL host, running version MAIN 7.02, has perl-HTTP-Tiny packages installed that are affected by a vulnerability: - HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to...

NewStart CGSL MAIN 7.02 : bind Multiple Vulnerabilities (NS-SA-2025-0108)

The remote NewStart CGSL host, running version MAIN 7.02, has bind packages installed that are affected by multiple vulnerabilities: - If a server hosts a zone containing a KEY Resource Record, or a resolver DNSSEC-validates a KEY Resource Record from a DNSSEC-signed domain in cache, a client can...

NewStart CGSL MAIN 7.02 : wpa_supplicant Vulnerability (NS-SA-2025-0181)

The remote NewStart CGSL host, running version MAIN 7.02, has wpasupplicant packages installed that are affected by a vulnerability: - The implementation of PEAP in wpasupplicant through 2.10 allows authentication bypass. For a successful attack, wpasupplicant must be configured to not verify the...

SUSE CVE-2025-49087

In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS7 padding mode is used...

K000152723: Golang crypto/tls vulnerabilities CVE-2023-39321 and CVE-2023-39322

Security Advisory Description CVE-2023-39321 Processing an incomplete post-handshake message for a QUIC connection can cause a panic. CVE-2023-39322 QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection...