Описание
Security update for haproxy
haproxy was updated to fix two security issues.
These security issues were fixed:
- CVE-2015-3281: Information disclosure (bsc#937042).
- CVE-2015-4000: The Logjam Attack / weakdh.org (bsc#937202).
Список пакетов
SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5
SUSE Linux Enterprise High Availability Extension 12
Ссылки
- Link for SUSE-SU-2015:1663-1
- E-Mail link for SUSE-SU-2015:1663-1
- SUSE Security Ratings
- SUSE Bug 937042
- SUSE Bug 937202
- SUSE CVE CVE-2015-3281 page
- SUSE CVE CVE-2015-4000 page
Описание
The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.
Затронутые продукты
Ссылки
- CVE-2015-3281
- SUSE Bug 937042
- SUSE Bug 937202
Описание
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Затронутые продукты
Ссылки
- CVE-2015-4000
- SUSE Bug 1074631
- SUSE Bug 1211968
- SUSE Bug 931600
- SUSE Bug 931698
- SUSE Bug 931723
- SUSE Bug 931845
- SUSE Bug 932026
- SUSE Bug 932483
- SUSE Bug 934789
- SUSE Bug 935033
- SUSE Bug 935540
- SUSE Bug 935979
- SUSE Bug 937202
- SUSE Bug 937766
- SUSE Bug 938248
- SUSE Bug 938432
- SUSE Bug 938895
- SUSE Bug 938905
- SUSE Bug 938906