Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-0691 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T03:35:49.057Z Vendors: Softbank, NTT docomo, KDDI Products: Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) Problem Types: Fails to verify SSL certificates Description: Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS pr
ion: Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://www.au.com/information/notice_mobile/service/2018-002/ - https://www.softbank.jp/mob
am Container: References: - https://www.au.com/information/notice_mobile/service/2018-002/ - https://www.softbank.jp/mobile/info/personal/news/service/20180927a/ - http://jvn.jp/en/jp/JVN37288228/index.html - https://www.nttdocomo.co.jp/info/notice/page/180927_00.html
CVE ID: CVE-2018-0692 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T03:35:48.936Z Vendors: Baidu, Inc. Products: Baidu Browser Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN77885134/index.html
CVE ID: CVE-2018-0693 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T03:35:48.951Z Vendors: Soliton Systems K.K. Products: FileZen Problem Types: Directory traversal Description: Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in the specific directory in FileZen via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN95355683/index.html - https://www.soliton.co.jp/support/2018/003328.html
CVE ID: CVE-2018-0694 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T03:35:49.106Z Vendors: Soliton Systems K.K. Products: FileZen Problem Types: OS Command Injection Description: FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN95355683/index.html - https://www.soliton.co.jp/support/2018/003328.html
CVE ID: CVE-2018-0695 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T03:35:48.944Z Vendors: USVN Team Products: User-friendly SVN (USVN) Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN73794686/index.html - http://www.usvn.info/2018/10/02/usvn-1.0.8
CVE ID: CVE-2018-0696 State: PUBLISHED Published: 2019-02-13T18:00:00 Last Updated: 2024-08-05T03:35:49.004Z Vendors: OpenAM Consortium Products: OpenAM Problem Types: Fails to manage sessions Description: OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN49995005/index.html - https://www.cs.themistruct.com/report/wam20181012 - https://www.osstech.co.jp/support/am2018-4-1-en
CVE ID: CVE-2018-0697 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T03:35:49.107Z Vendors: Metabase, Inc. Products: Metabase Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN14323043/index.html - https://metabase.com/
CVE ID: CVE-2018-0698 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T03:35:49.060Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN96493183/index.html - https://weseek.co.jp/security/2018/12/25/growi-prevent-xss2/
CVE ID: CVE-2018-0699 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T03:35:49.162Z Vendors: Hiroshi Yuki Products: YukiWiki Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN36343375/index.html - http://www.hyuki.com/yukiwiki/
CVE ID: CVE-2018-0700 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T03:35:49.000Z Vendors: Hiroshi Yuki Products: YukiWiki Problem Types: Denial-of-service (DoS) Description: YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of CPU and memory resources and may result in causing a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN36343375/index.html - http://www.hyuki.com/yukiwiki/
CVE ID: CVE-2018-0701 State: PUBLISHED Published: 2018-11-15T15:00:00 Last Updated: 2024-08-05T03:35:48.999Z Vendors: BlueStacks Products: BlueStacks App Player Problem Types: Fails to restrict access Description: BlueStacks App Player (BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and later) allows an attacker on the same network segment to bypass access restriction to gain unauthorized access. Additional Analyst Notes: - CVE Program Container: References: - https://support.bluestacks.com/hc/en-us/articles/360018274091 - http://jvn.jp/en/jp/JVN60702986/index.html
CVE ID: CVE-2018-0702 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T03:35:48.997Z Vendors: Cybozu, Inc. Products: Cybozu Mailwise Problem Types: Directory traversal Description: Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cybozu.support/article/34135/ - https://jvn.jp/en/jp/JVN83739174/index.html
CVE ID: CVE-2018-0703 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T03:35:48.939Z Vendors: Cybozu, Inc. Products: Cybozu Office Problem Types: Directory traversal Description: Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN15232217/index.html - https://kb.cybozu.support/article/34088/
CVE ID: CVE-2018-0704 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T03:35:48.963Z Vendors: Cybozu, Inc. Products: Cybozu Office Problem Types: Directory traversal Description: Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN15232217/index.html - https://kb.cybozu.support/article/34091/
CVE ID: CVE-2018-0705 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-05T03:35:48.908Z Vendors: Cybozu, Inc. Products: Cybozu Dezie Problem Types: Directory traversal Description: Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN16697622/index.html - https://kb.cybozu.support/article/34089/
CVE ID: CVE-2018-0706 State: PUBLISHED Published: 2018-07-16T15:00:00Z Last Updated: 2024-09-17T02:20:57.550Z Vendors: QNAP Products: Q'center Virtual Appliance Problem Types: Exposure of Private Information Description: Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45015/ - https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities - http://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virt
ilities - http://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html - https://www.exploit-db.com/exploits/45043/ - https://www.qnap.com/zh-tw/security-advisory/nas-201807-10 - https://www.securityfocus.com/archive/1/542141/100/0/threaded
CVE ID: CVE-2018-0707 State: PUBLISHED Published: 2018-07-16T15:00:00Z Last Updated: 2024-09-16T17:22:44.083Z Vendors: QNAP Products: Q'center Virtual Appliance Problem Types: Command Injection Description: Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45015/ - https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities - http://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtu
lities - http://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html - https://www.exploit-db.com/exploits/45043/ - https://www.qnap.com/zh-tw/security-advisory/nas-201807-10 - https://www.securityfocus.com/archive/1/542141/100/0/threaded
CVE ID: CVE-2018-0708 State: PUBLISHED Published: 2018-07-16T15:00:00Z Last Updated: 2024-09-16T17:03:30.561Z Vendors: QNAP Products: Q'center Virtual Appliance Problem Types: Command Injection Description: Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45015/ - https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities - http://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Ap
s - http://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html - https://www.qnap.com/zh-tw/security-advisory/nas-201807-10 - https://www.securityfocus.com/archive/1/542141/100/0/threaded
CVE ID: CVE-2018-0709 State: PUBLISHED Published: 2018-07-16T15:00:00Z Last Updated: 2024-09-17T01:57:01.146Z Vendors: QNAP Products: Q'center Virtual Appliance Problem Types: Command Injection Description: Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45015/ - https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities - http://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Applianc
tp://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html - https://www.qnap.com/zh-tw/security-advisory/nas-201807-10 - https://www.securityfocus.com/archive/1/542141/100/0/threaded
CVE ID: CVE-2018-0710 State: PUBLISHED Published: 2018-07-16T15:00:00Z Last Updated: 2024-09-16T18:03:44.775Z Vendors: QNAP Products: Q'center Virtual Appliance Problem Types: Command Injection Description: Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45015/ - https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities - http://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance
p://seclists.org/fulldisclosure/2018/Jul/45 - http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html - https://www.qnap.com/zh-tw/security-advisory/nas-201807-10 - https://www.securityfocus.com/archive/1/542141/100/0/threaded
CVE ID: CVE-2018-0711 State: PUBLISHED Published: 2018-04-30T13:00:00Z Last Updated: 2024-09-16T22:20:13.855Z Vendors: QNAP Products: QTS Problem Types: Cross-site scripting Description: Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201804-27 - http://www.securitytracker.com/id/1040779
CVE ID: CVE-2018-0712 State: PUBLISHED Published: 2018-06-21T13:00:00Z Last Updated: 2024-09-17T00:01:44.059Z Vendors: QNAP Products: LDAP Server in QTS Problem Types: Command Injection Description: Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions could allow remote attackers to run arbitrary commands or install malware on the NAS. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201806-19 - http://www.securitytracker.com/id/1041141
CVE ID: CVE-2018-0714 State: PUBLISHED Published: 2018-08-13T13:00:00Z Last Updated: 2024-09-16T16:27:50.158Z Vendors: QNAP Products: Helpdesk in QTS Problem Types: Command Injection Description: Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 and their earlier versions could allow remote attackers to run arbitrary commands in the compromised application. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201808-13
CVE ID: CVE-2018-0715 State: PUBLISHED Published: 2018-08-27T13:00:00Z Last Updated: 2024-09-17T00:56:55.960Z Vendors: QNAP Products: Photo Station Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201808-23 - https://www.exploit-db.com/exploits/45348/
CVE ID: CVE-2018-0716 State: PUBLISHED Published: 2018-11-30T14:00:00 Last Updated: 2024-08-05T03:35:49.284Z Vendors: QNAP Products: Qsync Central Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject Javascript code in the compromised application. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201811-29
CVE ID: CVE-2018-0718 State: PUBLISHED Published: 2018-09-14T13:00:00Z Last Updated: 2024-09-16T20:12:02.881Z Vendors: QNAP Products: Music Station Problem Types: Command Injection Description: Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised application. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201809-14
CVE ID: CVE-2018-0719 State: PUBLISHED Published: 2018-11-27T21:00:00Z Last Updated: 2024-09-16T20:22:21.156Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201809-20
CVE ID: CVE-2018-0721 State: PUBLISHED Published: 2018-11-27T22:00:00 Last Updated: 2024-08-05T03:35:49.256Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L) Vendors: QNAP Systems Inc. Products: QTS Problem Types: CWE-120 Description: Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201809-20
CVE ID: CVE-2018-0722 State: PUBLISHED Published: 2019-02-01T18:00:00Z Last Updated: 2024-09-16T21:56:56.471Z Vendors: QNAP Products: Photo Station Problem Types: Path Traversal Description: Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201901-14
CVE ID: CVE-2018-0723 State: PUBLISHED Published: 2018-12-26T16:00:00Z Last Updated: 2024-09-16T17:43:13.604Z Vendors: QNAP Products: Q'center Virtual Appliance Problem Types: Cross-site scripting Description: Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0724. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201812-26
CVE ID: CVE-2018-0724 State: PUBLISHED Published: 2018-12-26T16:00:00Z Last Updated: 2024-09-17T03:13:59.229Z Vendors: QNAP Products: Q'center Virtual Appliance Problem Types: Cross-site scripting Description: Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0723. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201812-26
CVE ID: CVE-2018-0728 State: PUBLISHED Published: 2019-12-04T16:27:47 Last Updated: 2024-08-05T03:35:49.201Z Vendors: n/a Products: QNAP NAS devices Problem Types: Improper Access Description: This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-20
CVE ID: CVE-2018-0729 State: PUBLISHED Published: 2019-12-04T16:33:08 Last Updated: 2024-08-05T03:35:49.140Z Vendors: n/a Products: QNAP NAS devices Problem Types: Commend Injection Description: This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-20
CVE ID: CVE-2018-0730 State: PUBLISHED Published: 2019-12-04T16:37:11 Last Updated: 2024-08-05T03:35:49.324Z Vendors: n/a Products: QNAP NAS devices Problem Types: Commend Injection Description: This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-20
CVE ID: CVE-2018-0731 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-0732 State: PUBLISHED Published: 2018-06-12T13:00:00Z Last Updated: 2024-09-17T02:11:18.325Z Vendors: OpenSSL Products: OpenSSL Problem Types: Client side Denial of Service Description: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o). Additional Analyst Notes: - CVE Program C
(Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o). Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html - http://www.securityfocus.com/bid/104442 - https://www.debian.org/security/2018/dsa-4355 - https://access.redhat.com/errata/RHSA-2018:2552 - https://security.gentoo.org/glsa/201811-03 - https://usn.ubuntu.com/3692-2/ - https://access.redhat.com/errata/RHSA-2018:2553 - https://access.redhat.com/errata/RHSA-2018:3505 - https://usn.ubuntu.com/3692-1/ - https://access.redhat.com/errata/RHSA-2018:3221 - https://www.debian.org/security/2018/dsa-4348 - http://www.securitytracker.com/id/1041
edhat.com/errata/RHSA-2018:3221 - https://www.debian.org/security/2018/dsa-4348 - http://www.securitytracker.com/id/1041090 - https://access.redhat.com/errata/RHSA-2019:1297 - https://access.redhat.com/errata/RHSA-2019:1296 - https://access.redhat.com/errata/RHSA-2019:1543 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/ - https://www.oracle.com/se