Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2016:3215-1

Опубликовано: 21 дек. 2016
Источник: suse-cvrf

Описание

Security update for shellinabox

shellinabox was updated to version 2.20 to fix the following security issues:

  • It was possible to fallback to the HTTP protocol even when configured for HTTPS. (CVE-2015-8400, boo#957748)
  • Disable secure client-initiated renegotiation
  • Set SSL options for increased security (disable SSLv2, SSLv3)
  • Protection against large HTTP requests

non security fixes:

  • Includes some MSIE and iOS rendering fixes

Список пакетов

openSUSE Leap 42.1
shellinabox-2.20-12.1
openSUSE Leap 42.2
shellinabox-2.20-12.1

Ссылки

Описание

The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL.

Затронутые продукты
openSUSE Leap 42.1:shellinabox-2.20-12.1
openSUSE Leap 42.2:shellinabox-2.20-12.1
Ссылки