Количество 1 025
Количество 1 025
SUSE-SU-2019:0803-1
Security update for openssl
SUSE-SU-2019:0600-1
Security update for openssl-1_0_0
SUSE-SU-2019:0572-1
Security update for openssl-1_0_0
GHSA-9ccq-7hvh-cv7p
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL ...
SUSE-SU-2023:4624-1
Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container
SUSE-SU-2023:4492-1
Security update for nghttp2
SUSE-SU-2023:4295-1
Security update for nodejs10
SUSE-SU-2023:4200-1
Security update for nghttp2
SUSE-SU-2023:4199-1
Security update for nghttp2
SUSE-SU-2023:4163-1
Security update for netty, netty-tcnative
RLSA-2023:5928
Important: tomcat security update
RLSA-2023:5924
Important: varnish security update
RLSA-2023:5838
Important: nghttp2 security update
RLSA-2023:5765
Important: nodejs security update
RLSA-2023:5749
Important: .NET 7.0 security update
RLSA-2023:5708
Important: dotnet6.0 security update
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | SUSE-SU-2019:0803-1 Security update for openssl | 4% Низкий | больше 6 лет назад | |
| SUSE-SU-2019:0600-1 Security update for openssl-1_0_0 | 4% Низкий | больше 6 лет назад | |
| SUSE-SU-2019:0572-1 Security update for openssl-1_0_0 | 4% Низкий | больше 6 лет назад | |
| GHSA-9ccq-7hvh-cv7p If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q). | CVSS3: 5.9 | 4% Низкий | больше 3 лет назад |
 | CVE-2019-1559 If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q). | CVSS3: 5.9 | 4% Низкий | больше 6 лет назад |
 | CVE-2019-1559 If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q). | CVSS3: 5.9 | 4% Низкий | больше 6 лет назад |
 | CVE-2019-1559 If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q). | CVSS3: 5.9 | 4% Низкий | больше 6 лет назад |
| CVE-2019-1559 If an application encounters a fatal protocol error and then calls SSL ... | CVSS3: 5.9 | 4% Низкий | больше 6 лет назад |
| SUSE-SU-2023:4624-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container | 94% Критический | почти 2 года назад | |
| SUSE-SU-2023:4492-1 Security update for nghttp2 | 94% Критический | почти 2 года назад | |
| SUSE-SU-2023:4295-1 Security update for nodejs10 | 94% Критический | около 2 лет назад | |
| SUSE-SU-2023:4200-1 Security update for nghttp2 | 94% Критический | около 2 лет назад | |
| SUSE-SU-2023:4199-1 Security update for nghttp2 | 94% Критический | около 2 лет назад | |
| SUSE-SU-2023:4163-1 Security update for netty, netty-tcnative | 94% Критический | около 2 лет назад | |
 | RLSA-2023:5928 Important: tomcat security update | 94% Критический | около 2 лет назад | |
| RLSA-2023:5924 Important: varnish security update | 94% Критический | около 2 лет назад | |
| RLSA-2023:5838 Important: nghttp2 security update | 94% Критический | около 2 лет назад | |
| RLSA-2023:5765 Important: nodejs security update | 94% Критический | около 2 лет назад | |
| RLSA-2023:5749 Important: .NET 7.0 security update | 94% Критический | около 2 лет назад | |
| RLSA-2023:5708 Important: dotnet6.0 security update | 94% Критический | около 2 лет назад |
Уязвимостей на страницу