p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Netzwerkdienste · Seite 8

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Netzwerkdienste: 25. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Netzwerkdienste

Sicherheitslücken: 186

  1. CVE-2023-0286

    Hoch · CVSS 7.4EPSS 69,29%Korrektur verfügbar

    X.400 address type confusion in X.509 GeneralName

    There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most

    openssl openssl openssl openssl cryptography openssl-src openssl-src openssl openssl edk2 openssl opensslBetriebssysteme Python Netzwerkdienste
    • Auf 1.0.1f-1ubuntu2.27+esm6 aktualisieren
    • Auf 1.0.2g-1ubuntu4.20+esm6 aktualisieren
    • Auf 1.0.2g-1ubuntu4.fips.4.20.6 aktualisieren
    • Auf 1.0.2n-1ubuntu5.11 aktualisieren
    • Auf 1.0.2zg aktualisieren
    • Auf 1.1.1-1ubuntu2.1~18.04.21 aktualisieren
    • Auf 1.1.1-1ubuntu2.fips.2.1~18.04.21 aktualisieren
    • Auf 1.1.1f-1ubuntu2.17 aktualisieren
    • Auf 1.1.1t aktualisieren
    • Auf 111.25.0 aktualisieren
    • Auf 3.0.8 aktualisieren
    • Auf 3.0.8-1 aktualisieren
    • Auf 300.0.12 aktualisieren
    • Auf 39.0.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2023-0401

    Hoch · CVSS 7.5EPSS 1,85%Korrektur verfügbar

    NULL dereference during PKCS7 data verification

    A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME l

    openssl openssl openssl openssl nodejs opensslBetriebssysteme Netzwerkdienste
    • Auf 12.22.9~dfsg-1ubuntu3.3 aktualisieren
    • Auf 3.0.2-0ubuntu1.8 aktualisieren
    • Auf 3.0.8 aktualisieren
    • Auf 3.0.8-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2022-3996

    Hoch · CVSS 7.5EPSS 1,31%Korrektur verfügbar

    X.509 Policy Constraints Double Locking

    If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.

    openssl openssl openssl openssl edk2 opensslBetriebssysteme Netzwerkdienste
    • Auf 3.0.2-0ubuntu1.9 aktualisieren
    • Auf 3.0.7-2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2022-3786

    Hoch · CVSS 7.5EPSS 92,49%Korrektur verfügbar

    X.509 Email Address Variable Length Buffer Overflow

    A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting

    openssl openssl openssl openssl opensslBetriebssysteme Netzwerkdienste
    • Auf 3.0.2-0ubuntu1.7 aktualisieren
    • Auf 3.0.7 aktualisieren
    • Auf 3.0.7-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2022-3602

    Hoch · CVSS 7.5EPSS 90,77%Korrektur verfügbar

    X.509 Email Address 4-byte Buffer Overflow

    A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitig

    openssl openssl openssl openssl opensslBetriebssysteme Netzwerkdienste
    • Auf 3.0.2-0ubuntu1.7 aktualisieren
    • Auf 3.0.7-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2022-3358

    Hoch · CVSS 7.5EPSS 4,01%Öffentlicher ExploitKorrektur verfügbar

    Using a Custom Cipher with NID_undef may lead to NULL encryption

    OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available

    openssl openssl openssl openssl edk2 opensslBetriebssysteme Netzwerkdienste
    • Auf 3.0.2-0ubuntu1.7 aktualisieren
    • Auf 3.0.7-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2022-2097

    Mittel · CVSS 5.3EPSS 4,9%Korrektur verfügbar

    AES OCB fails to encrypt some bytes

    AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

    openssl openssl openssl openssl edk2 openssl openssl openssl openssl openssl openssl nodejsBetriebssysteme Netzwerkdienste
    • Auf 1.1.1-1ubuntu2.1~18.04.20 aktualisieren
    • Auf 1.1.1-1ubuntu2.fips.2.1~18.04.20 aktualisieren
    • Auf 1.1.1f-1ubuntu2.16 aktualisieren
    • Auf 1.1.1f-1ubuntu2.fips.16 aktualisieren
    • Auf 12.22.9~dfsg-1ubuntu3.1 aktualisieren
    • Auf 3.0.2-0ubuntu1.6 aktualisieren
    • Auf 3.0.5-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2022-2274

    Kritisch · CVSS 9.8EPSS 48,23%Korrektur verfügbar

    RSA implementation bug in AVX512IFMA instructions

    The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.

    openssl openssl openssl openssl edk2Betriebssysteme Netzwerkdienste
    • Auf 3.0.4-2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2022-2068

    Kritisch · CVSS 9.8EPSS 96,39%Korrektur verfügbar

    The c_rehash script allows command injection

    In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.

    openssl openssl openssl openssl openssl openssl edk2 openssl openssl openssl openssl1.0 opensslBetriebssysteme Netzwerkdienste
    • Auf 1.0.1f-1ubuntu2.27+esm10 aktualisieren
    • Auf 1.0.2g-1ubuntu4.20+esm5 aktualisieren
    • Auf 1.0.2g-1ubuntu4.fips.4.20.3 aktualisieren
    • Auf 1.0.2n-1ubuntu5.10 aktualisieren
    • Auf 1.1.1-1ubuntu2.1~18.04.19 aktualisieren
    • Auf 1.1.1-1ubuntu2.fips.2.1~18.04.20 aktualisieren
    • Auf 1.1.1f-1ubuntu2.15 aktualisieren
    • Auf 1.1.1f-1ubuntu2.fips.16 aktualisieren
    • Auf 3.0.4-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2022-1473

    Hoch · CVSS 7.5EPSS 4,68%Korrektur verfügbar

    Resource leakage when decoding certificates and keys

    The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the Ope

    openssl openssl edk2 openssl openssl opensslBetriebssysteme Netzwerkdienste
    • Auf 1.0.2g-1ubuntu4.20+esm3 aktualisieren
    • Auf 1.0.2g-1ubuntu4.fips.4.20.3 aktualisieren
    • Auf 3.0.2-0ubuntu1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2022-1434

    Mittel · CVSS 5.9EPSS 1,23%Korrektur verfügbar

    Incorrect MAC key used in the RC4-MD5 ciphersuite

    The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint will always be rejected by the recipient and the connection will fail at that point. Many application protocols require data to be sent from the client to the server first. Therefore, in such a case, o

    openssl edk2 opensslBetriebssysteme Netzwerkdienste
    • Auf 3.0.2-0ubuntu1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2022-1343

    Mittel · CVSS 5.3EPSS 2,14%Korrektur verfügbar

    OCSP_basic_verify may incorrectly verify the response signing certificate

    The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "oc

    openssl opensslBetriebssysteme Netzwerkdienste
    • Auf 3.0.2-0ubuntu1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2022-1292

    Kritisch · CVSS 9.8EPSS 82,61%Korrektur verfügbar

    The c_rehash script allows command injection

    The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

    openssl openssl openssl openssl openssl openssl edk2 openssl openssl openssl openssl1.0 opensslBetriebssysteme Netzwerkdienste
    • Auf 0~20160408.ffea0a2c-2ubuntu0.2+esm3 aktualisieren
    • Auf 1.0.1f-1ubuntu2.27+esm10 aktualisieren
    • Auf 1.0.2g-1ubuntu4.20+esm3 aktualisieren
    • Auf 1.0.2g-1ubuntu4.fips.4.20.3 aktualisieren
    • Auf 1.0.2n-1ubuntu5.9 aktualisieren
    • Auf 1.1.1-1ubuntu2.1~18.04.17 aktualisieren
    • Auf 1.1.1-1ubuntu2.fips.2.1~18.04.17 aktualisieren
    • Auf 1.1.1f-1ubuntu2.13 aktualisieren
    • Auf 1.1.1f-1ubuntu2.fips.13.1 aktualisieren
    • Auf 1.1.1o-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2022-0778

    Hoch · CVSS 7.5EPSS 73,19%Öffentlicher ExploitKorrektur verfügbar

    Infinite loop in BN_mod_sqrt() reachable when parsing certificates

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. T

    openssl openssl openssl openssl openssl openssl openssl openssl openssl openssl1.0 edk2 opensslBetriebssysteme Netzwerkdienste
    • Auf 1.0.1f-1ubuntu2.27+esm5 aktualisieren
    • Auf 1.0.2g-1ubuntu4.20+esm2 aktualisieren
    • Auf 1.0.2g-1ubuntu4.fips.4.20.2 aktualisieren
    • Auf 1.0.2n-1ubuntu5.8 aktualisieren
    • Auf 1.1.1-1ubuntu2.1~18.04.15 aktualisieren
    • Auf 1.1.1-1ubuntu2.fips.2.1~18.04.15 aktualisieren
    • Auf 1.1.1f-1ubuntu2.12 aktualisieren
    • Auf 1.1.1f-1ubuntu2.fips.12 aktualisieren
    • Auf 1.1.1n-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2021-4160

    Mittel · CVSS 5.9EPSS 3,77%Korrektur verfügbar

    BN_mod_exp may produce incorrect results on MIPS

    There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such a

    openssl openssl openssl openssl edk2Betriebssysteme Netzwerkdienste
    • Auf 1.1.1m-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2021-4044

    Hoch · CVSS 7.5EPSS 50,1%Korrektur verfügbar

    Invalid handling of X509_verify_cert() internal errors in libssl

    Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this th

    openssl opensslBetriebssysteme Netzwerkdienste
    • Auf 3.0.1-0ubuntu1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2021-3712

    Hoch · CVSS 7.4EPSS 50,44%Korrektur verfügbar

    Read buffer overruns processing ASN.1 strings

    ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to direc

    openssl openssl openssl openssl openssl openssl edk2 openssl openssl openssl openssl1.0 edk2Betriebssysteme Netzwerkdienste
    • Auf 0~20191122.bd85bf54-2ubuntu3.3 aktualisieren
    • Auf 1.0.1f-1ubuntu2.27+esm4 aktualisieren
    • Auf 1.0.2g-1ubuntu4.20+esm1 aktualisieren
    • Auf 1.0.2g-1ubuntu4.fips.4.20.1 aktualisieren
    • Auf 1.0.2n-1ubuntu5.7 aktualisieren
    • Auf 1.1.1-1ubuntu2.1~18.04.13 aktualisieren
    • Auf 1.1.1-1ubuntu2.fips.2.1~18.04.13.2 aktualisieren
    • Auf 1.1.1f-1ubuntu2.8 aktualisieren
    • Auf 1.1.1l-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2021-3711

    Kritisch · CVSS 9.8EPSS 87,82%Korrektur verfügbar

    SM2 Decryption Buffer Overflow

    In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the fir

    openssl openssl openssl openssl openssl openssl openssl openssl openssl openssl opensslBetriebssysteme Netzwerkdienste
    • Auf 1.1.1-1ubuntu2.1~18.04.13 aktualisieren
    • Auf 1.1.1-1ubuntu2.fips.2.1~18.04.13.2 aktualisieren
    • Auf 1.1.1f-1ubuntu2.8 aktualisieren
    • Auf 1.1.1f-1ubuntu2.fips.7.2 aktualisieren
    • Auf 1.1.1l-1 aktualisieren
    • Auf 1.1.1l-1ubuntu1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2021-3450

    Hoch · CVSS 7.4EPSS 18,34%Korrektur verfügbar

    CA certificate check bypass with X509_V_FLAG_X509_STRICT

    The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there

    openssl openssl openssl opensslBetriebssysteme Netzwerkdienste
    • Auf 1.1.1k-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2021-3449

    Mittel · CVSS 5.9EPSS 63,54%Korrektur verfügbar

    NULL pointer deref in signature_algorithms processing

    An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to Op

    openssl openssl openssl openssl openssl postgresql-10 openssl openssl openssl postgresql-12 openssl opensslBetriebssysteme Netzwerkdienste
    • Auf 1.1.1-1ubuntu2.1~18.04.9 aktualisieren
    • Auf 1.1.1-1ubuntu2.fips.2.1~18.04.9.1 aktualisieren
    • Auf 1.1.1f-1ubuntu2.3 aktualisieren
    • Auf 1.1.1f-1ubuntu2.fips.2.8 aktualisieren
    • Auf 1.1.1f-1ubuntu2.fips.7 aktualisieren
    • Auf 1.1.1k-1 aktualisieren
    • Auf 10.18-0ubuntu0.18.04.1 aktualisieren
    • Auf 12.8-0ubuntu0.20.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →