var-201609-0597
Vulnerability from variot
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. TLS (Transport Layer Security) is a set of protocols used to provide confidentiality and data integrity between two communication applications. SSH (full name Secure Shell) is a set of security protocols based on the application layer and transport layer developed by the Network Working Group of the Internet Engineering Task Force (IETF). IPSec (full name Internet Protocol Security) is a set of IP security protocols established by the IPSec group of the Internet Engineering Task Force (IETF). Both DES and Triple DES are encryption algorithms. There are information leakage vulnerabilities in the DES and Triple DES encryption algorithms used in the TLS, SSH, and IPSec protocols and other protocols and products. This vulnerability stems from configuration errors in network systems or products during operation. (CVE-2016-2183)
- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: python security update Advisory ID: RHSA-2018:2123-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:2123 Issue date: 2018-07-03 CVE Names: CVE-2016-2183 =====================================================================
- Summary:
An update for python is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, ppc64le, s390x
- Description:
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
- A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183)
Note: This update modifies the Python ssl module to disable 3DES cipher suites by default.
Red Hat would like to thank OpenVPN for reporting this issue. Upstream acknowledges Karthikeyan Bhargavan (Inria) and GaA<<tan Leurent (Inria) as the original reporters.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
1369383 - CVE-2016-2183 SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source: python-2.7.5-69.el7_5.src.rpm
x86_64: python-2.7.5-69.el7_5.x86_64.rpm python-debuginfo-2.7.5-69.el7_5.i686.rpm python-debuginfo-2.7.5-69.el7_5.x86_64.rpm python-libs-2.7.5-69.el7_5.i686.rpm python-libs-2.7.5-69.el7_5.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: python-debug-2.7.5-69.el7_5.x86_64.rpm python-debuginfo-2.7.5-69.el7_5.x86_64.rpm python-devel-2.7.5-69.el7_5.x86_64.rpm python-test-2.7.5-69.el7_5.x86_64.rpm python-tools-2.7.5-69.el7_5.x86_64.rpm tkinter-2.7.5-69.el7_5.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: python-2.7.5-69.el7_5.src.rpm
x86_64: python-2.7.5-69.el7_5.x86_64.rpm python-debuginfo-2.7.5-69.el7_5.i686.rpm python-debuginfo-2.7.5-69.el7_5.x86_64.rpm python-devel-2.7.5-69.el7_5.x86_64.rpm python-libs-2.7.5-69.el7_5.i686.rpm python-libs-2.7.5-69.el7_5.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: python-debug-2.7.5-69.el7_5.x86_64.rpm python-debuginfo-2.7.5-69.el7_5.x86_64.rpm python-test-2.7.5-69.el7_5.x86_64.rpm python-tools-2.7.5-69.el7_5.x86_64.rpm tkinter-2.7.5-69.el7_5.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: python-2.7.5-69.el7_5.src.rpm
ppc64: python-2.7.5-69.el7_5.ppc64.rpm python-debuginfo-2.7.5-69.el7_5.ppc.rpm python-debuginfo-2.7.5-69.el7_5.ppc64.rpm python-devel-2.7.5-69.el7_5.ppc64.rpm python-libs-2.7.5-69.el7_5.ppc.rpm python-libs-2.7.5-69.el7_5.ppc64.rpm
ppc64le: python-2.7.5-69.el7_5.ppc64le.rpm python-debuginfo-2.7.5-69.el7_5.ppc64le.rpm python-devel-2.7.5-69.el7_5.ppc64le.rpm python-libs-2.7.5-69.el7_5.ppc64le.rpm
s390x: python-2.7.5-69.el7_5.s390x.rpm python-debuginfo-2.7.5-69.el7_5.s390.rpm python-debuginfo-2.7.5-69.el7_5.s390x.rpm python-devel-2.7.5-69.el7_5.s390x.rpm python-libs-2.7.5-69.el7_5.s390.rpm python-libs-2.7.5-69.el7_5.s390x.rpm
x86_64: python-2.7.5-69.el7_5.x86_64.rpm python-debuginfo-2.7.5-69.el7_5.i686.rpm python-debuginfo-2.7.5-69.el7_5.x86_64.rpm python-devel-2.7.5-69.el7_5.x86_64.rpm python-libs-2.7.5-69.el7_5.i686.rpm python-libs-2.7.5-69.el7_5.x86_64.rpm
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):
Source: python-2.7.5-69.el7_5.src.rpm
aarch64: python-2.7.5-69.el7_5.aarch64.rpm python-debuginfo-2.7.5-69.el7_5.aarch64.rpm python-devel-2.7.5-69.el7_5.aarch64.rpm python-libs-2.7.5-69.el7_5.aarch64.rpm
ppc64le: python-2.7.5-69.el7_5.ppc64le.rpm python-debuginfo-2.7.5-69.el7_5.ppc64le.rpm python-devel-2.7.5-69.el7_5.ppc64le.rpm python-libs-2.7.5-69.el7_5.ppc64le.rpm
s390x: python-2.7.5-69.el7_5.s390x.rpm python-debuginfo-2.7.5-69.el7_5.s390.rpm python-debuginfo-2.7.5-69.el7_5.s390x.rpm python-devel-2.7.5-69.el7_5.s390x.rpm python-libs-2.7.5-69.el7_5.s390.rpm python-libs-2.7.5-69.el7_5.s390x.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64: python-debug-2.7.5-69.el7_5.ppc64.rpm python-debuginfo-2.7.5-69.el7_5.ppc64.rpm python-test-2.7.5-69.el7_5.ppc64.rpm python-tools-2.7.5-69.el7_5.ppc64.rpm tkinter-2.7.5-69.el7_5.ppc64.rpm
ppc64le: python-debug-2.7.5-69.el7_5.ppc64le.rpm python-debuginfo-2.7.5-69.el7_5.ppc64le.rpm python-test-2.7.5-69.el7_5.ppc64le.rpm python-tools-2.7.5-69.el7_5.ppc64le.rpm tkinter-2.7.5-69.el7_5.ppc64le.rpm
s390x: python-debug-2.7.5-69.el7_5.s390x.rpm python-debuginfo-2.7.5-69.el7_5.s390x.rpm python-test-2.7.5-69.el7_5.s390x.rpm python-tools-2.7.5-69.el7_5.s390x.rpm tkinter-2.7.5-69.el7_5.s390x.rpm
x86_64: python-debug-2.7.5-69.el7_5.x86_64.rpm python-debuginfo-2.7.5-69.el7_5.x86_64.rpm python-test-2.7.5-69.el7_5.x86_64.rpm python-tools-2.7.5-69.el7_5.x86_64.rpm tkinter-2.7.5-69.el7_5.x86_64.rpm
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7):
aarch64: python-debug-2.7.5-69.el7_5.aarch64.rpm python-debuginfo-2.7.5-69.el7_5.aarch64.rpm python-test-2.7.5-69.el7_5.aarch64.rpm python-tools-2.7.5-69.el7_5.aarch64.rpm tkinter-2.7.5-69.el7_5.aarch64.rpm
ppc64le: python-debug-2.7.5-69.el7_5.ppc64le.rpm python-debuginfo-2.7.5-69.el7_5.ppc64le.rpm python-test-2.7.5-69.el7_5.ppc64le.rpm python-tools-2.7.5-69.el7_5.ppc64le.rpm tkinter-2.7.5-69.el7_5.ppc64le.rpm
s390x: python-debug-2.7.5-69.el7_5.s390x.rpm python-debuginfo-2.7.5-69.el7_5.s390x.rpm python-test-2.7.5-69.el7_5.s390x.rpm python-tools-2.7.5-69.el7_5.s390x.rpm tkinter-2.7.5-69.el7_5.s390x.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: python-2.7.5-69.el7_5.src.rpm
x86_64: python-2.7.5-69.el7_5.x86_64.rpm python-debuginfo-2.7.5-69.el7_5.i686.rpm python-debuginfo-2.7.5-69.el7_5.x86_64.rpm python-devel-2.7.5-69.el7_5.x86_64.rpm python-libs-2.7.5-69.el7_5.i686.rpm python-libs-2.7.5-69.el7_5.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64: python-debug-2.7.5-69.el7_5.x86_64.rpm python-debuginfo-2.7.5-69.el7_5.x86_64.rpm python-test-2.7.5-69.el7_5.x86_64.rpm python-tools-2.7.5-69.el7_5.x86_64.rpm tkinter-2.7.5-69.el7_5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2016-2183 https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBWzuDSdzjgjWX9erEAQgETg/9HevQ3tUvI8plP6DSgN1Es+jArUKVGct5 cIlHbLXCGIcy1D2NAndEznF+6LSWo/Ynd2C5esSdD9R+KvJrmbNJ7s+XN4Uys4ea FyBlHvw56yuSiAcGvUCF+rjg2IaN9QCkH9oGKUNIHpfOdxNnHu3Yk8muNa5H2mXh v2yomcfl6voFIMxvxlVKO7ENkESH/vYYnXFS7S+pnBoEZb4/HTp000ASovjewroq xGBLDUKzTp9nOVWVWECA6La1o+nDi4wOZVDgF7Ks2kaYdAYSa3vkoAI1hN6XtZ3O T3Fv7iF1BqQt+B//tCeT3Fa5SsDulob3K5H2TqnMRlZSr0mst/89RePsbz2wFM+p 1wcklX9gVBI66y5XPfst/sNyLgWMkYgvUsYJTJHeYT0vAN+N54lcwjK1vxKCMFso 2ltd63+E5ql26E1pp//cAqAo7JhWqsaqNV8uY4oKzAHRRfQ9kdz/yq2DfA8aswDL 8nb1rjQ2tIRL/GtWL9ofhKey136qePvF5IwqF+jlO+N7wpG685KZF9zarNZqODxo p93VTJQ6+J0oXktvyJ8RS1XqkFvznocfEThgrhdmsWW4G6bjA2GyAoTWpDy3NUUv 6TxyeUjc6NvKb7t6wgrRuSBKkSRCaln+aBSakq012A50PNssvx7hNzVVl9zBgOv1 6NvSNmqGIdM= =AUgF -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 6) - i386, x86_64
- Description:
IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.
This update upgrades IBM Java SE 6 to version 6 SR16-FP41.
Security Fix(es):
-
This update fixes multiple vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-2183, CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2016-5552, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253, CVE-2017-3259, CVE-2017-3261, CVE-2017-3272)
-
Bugs fixed (https://bugzilla.redhat.com/):
1369383 - CVE-2016-2183 SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) 1413554 - CVE-2017-3272 OpenJDK: insufficient protected field access checks in atomic field updaters (Libraries, 8165344) 1413583 - CVE-2017-3253 OpenJDK: imageio PNGImageReader failed to honor ignoreMetadata for iTXt and zTXt chunks (2D, 8166988) 1413653 - CVE-2017-3261 OpenJDK: integer overflow in SocketOutputStream boundary check (Networking, 8164147) 1413717 - CVE-2017-3231 OpenJDK: URLClassLoader insufficient access control checks (Networking, 8151934) 1413882 - CVE-2016-5552 OpenJDK: incorrect URL parsing in URLStreamHandler (Networking, 8167223) 1413906 - CVE-2017-3252 OpenJDK: LdapLoginModule incorrect userDN extraction (JAAS, 8161743) 1413911 - CVE-2016-5546 OpenJDK: incorrect ECDSA signature extraction from the DER input (Libraries, 8168714) 1413920 - CVE-2016-5548 OpenJDK: DSA implementation timing attack (Libraries, 8168728) 1413923 - CVE-2016-5549 OpenJDK: ECDSA implementation timing attack (Libraries, 8168724) 1413955 - CVE-2017-3241 OpenJDK: untrusted input deserialization in RMI registry and DCG (RMI, 8156802) 1414163 - CVE-2017-3259 Oracle JDK: unspecified vulnerability fixed in 6u141, 7u131, and 8u121 (Deployment)
- Description:
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
See the following documentation, which will be updated shortly for release 3.11.170, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r elease_notes.html
This update is available via the Red Hat Network.
Ubuntu Security Notice USN-3179-1 January 25, 2017
openjdk-8 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.10
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in OpenJDK 8.
Software Description: - openjdk-8: Open Source Java implementation
Details:
Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. This update moves those algorithms to the legacy algorithm set and causes them to be used only if no non-legacy algorithms can be negotiated. (CVE-2016-2183)
It was discovered that OpenJDK accepted ECSDA signatures using non-canonical DER encoding. An attacker could use this to modify or expose sensitive data. (CVE-2016-5546)
It was discovered that OpenJDK did not properly verify object identifier (OID) length when reading Distinguished Encoding Rules (DER) records, as used in x.509 certificates and elsewhere. An attacker could use this to cause a denial of service (memory consumption). (CVE-2016-5547)
It was discovered that covert timing channel vulnerabilities existed in the DSA and ECDSA implementations in OpenJDK. A remote attacker could use this to expose sensitive information. (CVE-2016-5548, CVE-2016-5549)
It was discovered that the URLStreamHandler class in OpenJDK did not properly parse user information from a URL. A remote attacker could use this to expose sensitive information. (CVE-2016-5552)
It was discovered that the URLClassLoader class in OpenJDK did not properly check access control context when downloading class files. A remote attacker could use this to expose sensitive information. (CVE-2017-3231)
It was discovered that the Remote Method Invocation (RMI) implementation in OpenJDK performed deserialization of untrusted inputs. A remote attacker could use this to execute arbitrary code. (CVE-2017-3241)
It was discovered that the Java Authentication and Authorization Service (JAAS) component of OpenJDK did not properly perform user search LDAP queries. An attacker could use a specially constructed LDAP entry to expose or modify sensitive information. (CVE-2017-3252)
It was discovered that the PNGImageReader class in OpenJDK did not properly handle iTXt and zTXt chunks. An attacker could use this to cause a denial of service (memory consumption). (CVE-2017-3253)
It was discovered that integer overflows existed in the SocketInputStream and SocketOutputStream classes of OpenJDK. An attacker could use this to expose sensitive information. (CVE-2017-3261)
It was discovered that the atomic field updaters in the java.util.concurrent.atomic package in OpenJDK did not properly restrict access to protected field members. An attacker could use this to specially craft a Java application or applet that could bypass Java sandbox restrictions. (CVE-2017-3272)
It was discovered that a vulnerability existed in the class construction implementation in OpenJDK. An attacker could use this to specially craft a Java application or applet that could bypass Java sandbox restrictions. (CVE-2017-3289)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.10: openjdk-8-jdk 8u121-b13-0ubuntu1.16.10.2 openjdk-8-jdk-headless 8u121-b13-0ubuntu1.16.10.2 openjdk-8-jre 8u121-b13-0ubuntu1.16.10.2 openjdk-8-jre-headless 8u121-b13-0ubuntu1.16.10.2 openjdk-8-jre-jamvm 8u121-b13-0ubuntu1.16.10.2 openjdk-8-jre-zero 8u121-b13-0ubuntu1.16.10.2
Ubuntu 16.04 LTS: openjdk-8-jdk 8u121-b13-0ubuntu1.16.04.2 openjdk-8-jdk-headless 8u121-b13-0ubuntu1.16.04.2 openjdk-8-jre 8u121-b13-0ubuntu1.16.04.2 openjdk-8-jre-headless 8u121-b13-0ubuntu1.16.04.2 openjdk-8-jre-jamvm 8u121-b13-0ubuntu1.16.04.2 openjdk-8-jre-zero 8u121-b13-0ubuntu1.16.04.2
This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any Java applications or applets to make all the necessary changes.
Red Hat Quay is a secure, private container registry that builds, analyzes and distributes container images. It provides a high level of automation and customization. (CVE-2016-2183)
Bug Fix(es):
-
Running Quay in config mode now works in a disconnected option which doesn't require pulling resources from the Internet.
-
Quay's security scan endpoint is now enabled at startup for viewing results of Clair container image scans. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Note: the current version of the following document is available here: https://softwaresupport.hpe.com/document/-/facetsearch/document/KM03158613
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: KM03158613 Version: 1
MFSBGN03805 - HP Service Manager, Remote Disclosure of Information
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2018-05-10 Last Updated: 2018-05-10
Potential Security Impact: Remote: Disclosure of Information
Source: Micro Focus, Product Security Response Team
VULNERABILITY SUMMARY A potential security vulnerability has been identified in Service Manager. This vulnerability may allow an exploit against a long-duration encrypted session known as the Sweet32 attack, and which may be exploited remotely.
References:
- CVE-2016-2183
- CVE-2016-6329
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
- HP Service Manager Software - v9.30, v9.31, v9.32, v9.33, v9.34, v9.35, v9.40, v9.41, v9.50, v9.51
BACKGROUND
CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector
RESOLUTION
MicroFocus has made the following information available to resolve the vulnerability for the impacted versions of Service Manager:
For versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35 please upgrade to SM 9.35.P6:
SM9.35 P6 packages, SM 9.35 AIX Server 9.35.6007 p6 http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00916
SM 9.35 HP Itanium Server 9.35.6007 p6 http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00917
SM 9.35 HP Itanium Server for Oracle 12c 9.35.6007 p6 http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00918
SM 9.35 Linux Server 9.35.6007 p6 http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00919
SM 9.35 Solaris Server 9.35.6007 p6 http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00920
SM 9.35 Windows Server 9.35.6007 p6 http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00921
For version 9.40, 9.41 please upgrade to SM 9.41.P6:
SM9.41.P6 packages, Service Manager 9.41.6000 p6 - Server for AIX http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00891
Service Manager 9.41.6000 p6 - Server for HP-UX/IA http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00892
Service Manager 9.41.6000 p6 - Server for Linux http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00893
Service Manager 9.41.6000 p6 - Server for Solaris http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00894
Service Manager 9.41.6000 p6 - Server for Windows http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00895
For version 9.50, 9.51 Server and KM components please upgrade to SM 9.52.P2:
SM9.52.P2 packages, Service Manager 9.52.2021 p2 - Server for Windows http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00906
Service Manager 9.52.2021 p2 - Server for Linux http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/- facetsearch/document/LID/HPSM_00907
For version 9.50, 9.51 SMSP and SMC components please upgrade to SM 9.52:
SM9.52 packages, Service Manager 9.52 as a minor.minor full (MMF) release (due to the new SP aggregation SKU for Propel customers) is released on the following sites instead of SSO. https://h22255.www2.hpe.com/mysoftware/index
HISTORY Version:1 (rev.1) - 10 May 2018 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running Micro Focus products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal Micro Focus services support channel. For other issues about the content of this Security Bulletin, send e-mail to cyber-psrt@microfocus.com.
Report: To report a potential security vulnerability for any supported product: Web form: https://www.microfocus.com/support-and-services/report-security Email: security@microfocus.com
Subscribe: To initiate receiving subscriptions for future Micro Focus Security Bulletin alerts via Email, please subscribe here - https://softwaresupport.hpe.com/group/softwaresupport/email-notification/-/subscriptions/registerdocumentnotification Once you are logged in to the portal, please choose security bulletins under product and document types. Please note that you will need to sign in using a Passport account. If you do not have a Passport account yet, you can create one- its free and easy https://cf.passport.softwaregrp.com/hppcf/createuser.do
Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://softwaresupport.hpe.com/security-vulnerability
Software Product Category: The Software Product Category is represented in the title by the two characters following Micro Focus Security Bulletin.
3P = 3rd Party Software GN = Micro Focus General Software MU = Multi-Platform Software
System management and security procedures must be reviewed frequently to maintain system integrity. Micro Focus is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"Micro Focus is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected Micro Focus products the important security information contained in this Bulletin. Micro Focus recommends that all users determine the applicability of this information to their individual situations and take appropriate action. Micro Focus does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, Micro Focus will not be responsible for any damages resulting from user's use or disregard of the information provided in this Security Bulletin. To the extent permitted by law, Micro Focus disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
Copyright 2017 EntIT Software LLC
Micro Focus shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither Micro Focus nor its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Micro Focus and the names of Micro Focus products referenced herein are trademarks of Micro Focus in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.
This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 2 serves as an update for Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
-
It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788)
-
It was discovered that in httpd 2.4, the internal API function ap_some_auth_required() could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied. JIRA issues fixed (https://issues.jboss.org/):
JBCS-329 - Unable to load large CRL openssl problem
6
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201609-0597",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1r"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1d"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1a"
},
{
"model": "python",
"scope": "gte",
"trust": 1.0,
"vendor": "python",
"version": "2.7.0"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1b"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1f"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1i"
},
{
"model": "node.js",
"scope": "lt",
"trust": 1.0,
"vendor": "nodejs",
"version": "0.12.16"
},
{
"model": "python",
"scope": "gte",
"trust": 1.0,
"vendor": "python",
"version": "3.5.0"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1n"
},
{
"model": "python",
"scope": "lt",
"trust": 1.0,
"vendor": "python",
"version": "3.5.3"
},
{
"model": "node.js",
"scope": "lt",
"trust": 1.0,
"vendor": "nodejs",
"version": "4.1.2"
},
{
"model": "node.js",
"scope": "lt",
"trust": 1.0,
"vendor": "nodejs",
"version": "4.6.0"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.0"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1k"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1o"
},
{
"model": "content security management appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "9.7.0-006"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.2e"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1g"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1m"
},
{
"model": "content security management appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "9.6.6-068"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.2h"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1c"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1l"
},
{
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "4.2.0"
},
{
"model": "node.js",
"scope": "lt",
"trust": 1.0,
"vendor": "nodejs",
"version": "6.7.0"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1p"
},
{
"model": "jboss enterprise web server",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "2.0.0"
},
{
"model": "python",
"scope": "lt",
"trust": 1.0,
"vendor": "python",
"version": "2.7.13"
},
{
"model": "jboss enterprise application platform",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0.0"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1h"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1e"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.2b"
},
{
"model": "python",
"scope": "lt",
"trust": 1.0,
"vendor": "python",
"version": "3.4.7"
},
{
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "4.0.0"
},
{
"model": "python",
"scope": "gte",
"trust": 1.0,
"vendor": "python",
"version": "3.4.0"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.2f"
},
{
"model": "database",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "12.1.0.2"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "5.0"
},
{
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "0.10.0"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1j"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.2d"
},
{
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "0.12.0"
},
{
"model": "node.js",
"scope": "lt",
"trust": 1.0,
"vendor": "nodejs",
"version": "0.10.47"
},
{
"model": "database",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "11.2.0.4"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.2a"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1t"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.1q"
},
{
"model": "node.js",
"scope": "gte",
"trust": 1.0,
"vendor": "nodejs",
"version": "6.0.0"
},
{
"model": "jboss web server",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "3.0"
},
{
"model": "jboss enterprise web server",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "1.0.0"
},
{
"model": "openssl",
"scope": "eq",
"trust": 1.0,
"vendor": "openssl",
"version": "1.0.2c"
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2016-2183"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "154650"
},
{
"db": "PACKETSTORM",
"id": "148410"
},
{
"db": "PACKETSTORM",
"id": "141353"
},
{
"db": "PACKETSTORM",
"id": "156451"
},
{
"db": "PACKETSTORM",
"id": "152978"
},
{
"db": "PACKETSTORM",
"id": "144134"
}
],
"trust": 0.6
},
"cve": "CVE-2016-2183",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2016-2183",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-91002",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2016-2183",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-2183",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-91002",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-91002"
},
{
"db": "NVD",
"id": "CVE-2016-2183"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack. TLS (Transport Layer Security) is a set of protocols used to provide confidentiality and data integrity between two communication applications. SSH (full name Secure Shell) is a set of security protocols based on the application layer and transport layer developed by the Network Working Group of the Internet Engineering Task Force (IETF). IPSec (full name Internet Protocol Security) is a set of IP security protocols established by the IPSec group of the Internet Engineering Task Force (IETF). Both DES and Triple DES are encryption algorithms. There are information leakage vulnerabilities in the DES and Triple DES encryption algorithms used in the TLS, SSH, and IPSec protocols and other protocols and products. This vulnerability stems from configuration errors in network systems or products during operation. (CVE-2016-2183)\n\n3. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Moderate: python security update\nAdvisory ID: RHSA-2018:2123-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2018:2123\nIssue date: 2018-07-03\nCVE Names: CVE-2016-2183 \n=====================================================================\n\n1. Summary:\n\nAn update for python is now available for Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, ppc64le, s390x\n\n3. Description:\n\nPython is an interpreted, interactive, object-oriented programming\nlanguage, which includes modules, classes, exceptions, very high level\ndynamic data types and dynamic typing. Python supports interfaces to many\nsystem calls and libraries, as well as to various windowing systems. \n\nSecurity Fix(es):\n\n* A flaw was found in the way the DES/3DES cipher was used as part of the\nTLS/SSL protocol. A man-in-the-middle attacker could use this flaw to\nrecover some plaintext data by capturing large amounts of encrypted traffic\nbetween TLS/SSL server and client if the communication used a DES/3DES\nbased ciphersuite. (CVE-2016-2183)\n\nNote: This update modifies the Python ssl module to disable 3DES cipher\nsuites by default. \n\nRed Hat would like to thank OpenVPN for reporting this issue. Upstream\nacknowledges Karthikeyan Bhargavan (Inria) and GaA\u003c\u003ctan Leurent (Inria) as\nthe original reporters. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1369383 - CVE-2016-2183 SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)\n\n6. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\npython-2.7.5-69.el7_5.src.rpm\n\nx86_64:\npython-2.7.5-69.el7_5.x86_64.rpm\npython-debuginfo-2.7.5-69.el7_5.i686.rpm\npython-debuginfo-2.7.5-69.el7_5.x86_64.rpm\npython-libs-2.7.5-69.el7_5.i686.rpm\npython-libs-2.7.5-69.el7_5.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\npython-debug-2.7.5-69.el7_5.x86_64.rpm\npython-debuginfo-2.7.5-69.el7_5.x86_64.rpm\npython-devel-2.7.5-69.el7_5.x86_64.rpm\npython-test-2.7.5-69.el7_5.x86_64.rpm\npython-tools-2.7.5-69.el7_5.x86_64.rpm\ntkinter-2.7.5-69.el7_5.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\npython-2.7.5-69.el7_5.src.rpm\n\nx86_64:\npython-2.7.5-69.el7_5.x86_64.rpm\npython-debuginfo-2.7.5-69.el7_5.i686.rpm\npython-debuginfo-2.7.5-69.el7_5.x86_64.rpm\npython-devel-2.7.5-69.el7_5.x86_64.rpm\npython-libs-2.7.5-69.el7_5.i686.rpm\npython-libs-2.7.5-69.el7_5.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nx86_64:\npython-debug-2.7.5-69.el7_5.x86_64.rpm\npython-debuginfo-2.7.5-69.el7_5.x86_64.rpm\npython-test-2.7.5-69.el7_5.x86_64.rpm\npython-tools-2.7.5-69.el7_5.x86_64.rpm\ntkinter-2.7.5-69.el7_5.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\npython-2.7.5-69.el7_5.src.rpm\n\nppc64:\npython-2.7.5-69.el7_5.ppc64.rpm\npython-debuginfo-2.7.5-69.el7_5.ppc.rpm\npython-debuginfo-2.7.5-69.el7_5.ppc64.rpm\npython-devel-2.7.5-69.el7_5.ppc64.rpm\npython-libs-2.7.5-69.el7_5.ppc.rpm\npython-libs-2.7.5-69.el7_5.ppc64.rpm\n\nppc64le:\npython-2.7.5-69.el7_5.ppc64le.rpm\npython-debuginfo-2.7.5-69.el7_5.ppc64le.rpm\npython-devel-2.7.5-69.el7_5.ppc64le.rpm\npython-libs-2.7.5-69.el7_5.ppc64le.rpm\n\ns390x:\npython-2.7.5-69.el7_5.s390x.rpm\npython-debuginfo-2.7.5-69.el7_5.s390.rpm\npython-debuginfo-2.7.5-69.el7_5.s390x.rpm\npython-devel-2.7.5-69.el7_5.s390x.rpm\npython-libs-2.7.5-69.el7_5.s390.rpm\npython-libs-2.7.5-69.el7_5.s390x.rpm\n\nx86_64:\npython-2.7.5-69.el7_5.x86_64.rpm\npython-debuginfo-2.7.5-69.el7_5.i686.rpm\npython-debuginfo-2.7.5-69.el7_5.x86_64.rpm\npython-devel-2.7.5-69.el7_5.x86_64.rpm\npython-libs-2.7.5-69.el7_5.i686.rpm\npython-libs-2.7.5-69.el7_5.x86_64.rpm\n\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):\n\nSource:\npython-2.7.5-69.el7_5.src.rpm\n\naarch64:\npython-2.7.5-69.el7_5.aarch64.rpm\npython-debuginfo-2.7.5-69.el7_5.aarch64.rpm\npython-devel-2.7.5-69.el7_5.aarch64.rpm\npython-libs-2.7.5-69.el7_5.aarch64.rpm\n\nppc64le:\npython-2.7.5-69.el7_5.ppc64le.rpm\npython-debuginfo-2.7.5-69.el7_5.ppc64le.rpm\npython-devel-2.7.5-69.el7_5.ppc64le.rpm\npython-libs-2.7.5-69.el7_5.ppc64le.rpm\n\ns390x:\npython-2.7.5-69.el7_5.s390x.rpm\npython-debuginfo-2.7.5-69.el7_5.s390.rpm\npython-debuginfo-2.7.5-69.el7_5.s390x.rpm\npython-devel-2.7.5-69.el7_5.s390x.rpm\npython-libs-2.7.5-69.el7_5.s390.rpm\npython-libs-2.7.5-69.el7_5.s390x.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nppc64:\npython-debug-2.7.5-69.el7_5.ppc64.rpm\npython-debuginfo-2.7.5-69.el7_5.ppc64.rpm\npython-test-2.7.5-69.el7_5.ppc64.rpm\npython-tools-2.7.5-69.el7_5.ppc64.rpm\ntkinter-2.7.5-69.el7_5.ppc64.rpm\n\nppc64le:\npython-debug-2.7.5-69.el7_5.ppc64le.rpm\npython-debuginfo-2.7.5-69.el7_5.ppc64le.rpm\npython-test-2.7.5-69.el7_5.ppc64le.rpm\npython-tools-2.7.5-69.el7_5.ppc64le.rpm\ntkinter-2.7.5-69.el7_5.ppc64le.rpm\n\ns390x:\npython-debug-2.7.5-69.el7_5.s390x.rpm\npython-debuginfo-2.7.5-69.el7_5.s390x.rpm\npython-test-2.7.5-69.el7_5.s390x.rpm\npython-tools-2.7.5-69.el7_5.s390x.rpm\ntkinter-2.7.5-69.el7_5.s390x.rpm\n\nx86_64:\npython-debug-2.7.5-69.el7_5.x86_64.rpm\npython-debuginfo-2.7.5-69.el7_5.x86_64.rpm\npython-test-2.7.5-69.el7_5.x86_64.rpm\npython-tools-2.7.5-69.el7_5.x86_64.rpm\ntkinter-2.7.5-69.el7_5.x86_64.rpm\n\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7):\n\naarch64:\npython-debug-2.7.5-69.el7_5.aarch64.rpm\npython-debuginfo-2.7.5-69.el7_5.aarch64.rpm\npython-test-2.7.5-69.el7_5.aarch64.rpm\npython-tools-2.7.5-69.el7_5.aarch64.rpm\ntkinter-2.7.5-69.el7_5.aarch64.rpm\n\nppc64le:\npython-debug-2.7.5-69.el7_5.ppc64le.rpm\npython-debuginfo-2.7.5-69.el7_5.ppc64le.rpm\npython-test-2.7.5-69.el7_5.ppc64le.rpm\npython-tools-2.7.5-69.el7_5.ppc64le.rpm\ntkinter-2.7.5-69.el7_5.ppc64le.rpm\n\ns390x:\npython-debug-2.7.5-69.el7_5.s390x.rpm\npython-debuginfo-2.7.5-69.el7_5.s390x.rpm\npython-test-2.7.5-69.el7_5.s390x.rpm\npython-tools-2.7.5-69.el7_5.s390x.rpm\ntkinter-2.7.5-69.el7_5.s390x.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\npython-2.7.5-69.el7_5.src.rpm\n\nx86_64:\npython-2.7.5-69.el7_5.x86_64.rpm\npython-debuginfo-2.7.5-69.el7_5.i686.rpm\npython-debuginfo-2.7.5-69.el7_5.x86_64.rpm\npython-devel-2.7.5-69.el7_5.x86_64.rpm\npython-libs-2.7.5-69.el7_5.i686.rpm\npython-libs-2.7.5-69.el7_5.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\npython-debug-2.7.5-69.el7_5.x86_64.rpm\npython-debuginfo-2.7.5-69.el7_5.x86_64.rpm\npython-test-2.7.5-69.el7_5.x86_64.rpm\npython-tools-2.7.5-69.el7_5.x86_64.rpm\ntkinter-2.7.5-69.el7_5.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2016-2183\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBWzuDSdzjgjWX9erEAQgETg/9HevQ3tUvI8plP6DSgN1Es+jArUKVGct5\ncIlHbLXCGIcy1D2NAndEznF+6LSWo/Ynd2C5esSdD9R+KvJrmbNJ7s+XN4Uys4ea\nFyBlHvw56yuSiAcGvUCF+rjg2IaN9QCkH9oGKUNIHpfOdxNnHu3Yk8muNa5H2mXh\nv2yomcfl6voFIMxvxlVKO7ENkESH/vYYnXFS7S+pnBoEZb4/HTp000ASovjewroq\nxGBLDUKzTp9nOVWVWECA6La1o+nDi4wOZVDgF7Ks2kaYdAYSa3vkoAI1hN6XtZ3O\nT3Fv7iF1BqQt+B//tCeT3Fa5SsDulob3K5H2TqnMRlZSr0mst/89RePsbz2wFM+p\n1wcklX9gVBI66y5XPfst/sNyLgWMkYgvUsYJTJHeYT0vAN+N54lcwjK1vxKCMFso\n2ltd63+E5ql26E1pp//cAqAo7JhWqsaqNV8uY4oKzAHRRfQ9kdz/yq2DfA8aswDL\n8nb1rjQ2tIRL/GtWL9ofhKey136qePvF5IwqF+jlO+N7wpG685KZF9zarNZqODxo\np93VTJQ6+J0oXktvyJ8RS1XqkFvznocfEThgrhdmsWW4G6bjA2GyAoTWpDy3NUUv\n6TxyeUjc6NvKb7t6wgrRuSBKkSRCaln+aBSakq012A50PNssvx7hNzVVl9zBgOv1\n6NvSNmqGIdM=\n=AUgF\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. 6) - i386, x86_64\n\n3. Description:\n\nIBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM\nJava Software Development Kit. \n\nThis update upgrades IBM Java SE 6 to version 6 SR16-FP41. \n\nSecurity Fix(es):\n\n* This update fixes multiple vulnerabilities in the IBM Java Runtime\nEnvironment and the IBM Java Software Development Kit. Further information\nabout these flaws can be found on the IBM Java Security alerts page, listed\nin the References section. (CVE-2016-2183, CVE-2016-5546, CVE-2016-5548,\nCVE-2016-5549, CVE-2016-5552, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252,\nCVE-2017-3253, CVE-2017-3259, CVE-2017-3261, CVE-2017-3272)\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1369383 - CVE-2016-2183 SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)\n1413554 - CVE-2017-3272 OpenJDK: insufficient protected field access checks in atomic field updaters (Libraries, 8165344)\n1413583 - CVE-2017-3253 OpenJDK: imageio PNGImageReader failed to honor ignoreMetadata for iTXt and zTXt chunks (2D, 8166988)\n1413653 - CVE-2017-3261 OpenJDK: integer overflow in SocketOutputStream boundary check (Networking, 8164147)\n1413717 - CVE-2017-3231 OpenJDK: URLClassLoader insufficient access control checks (Networking, 8151934)\n1413882 - CVE-2016-5552 OpenJDK: incorrect URL parsing in URLStreamHandler (Networking, 8167223)\n1413906 - CVE-2017-3252 OpenJDK: LdapLoginModule incorrect userDN extraction (JAAS, 8161743)\n1413911 - CVE-2016-5546 OpenJDK: incorrect ECDSA signature extraction from the DER input (Libraries, 8168714)\n1413920 - CVE-2016-5548 OpenJDK: DSA implementation timing attack (Libraries, 8168728)\n1413923 - CVE-2016-5549 OpenJDK: ECDSA implementation timing attack (Libraries, 8168724)\n1413955 - CVE-2017-3241 OpenJDK: untrusted input deserialization in RMI registry and DCG (RMI, 8156802)\n1414163 - CVE-2017-3259 Oracle JDK: unspecified vulnerability fixed in 6u141, 7u131, and 8u121 (Deployment)\n\n6. Description:\n\nRed Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments. \n\nSee the following documentation, which will be updated shortly for release\n3.11.170, for important instructions on how to upgrade your cluster and\nfully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r\nelease_notes.html\n\nThis update is available via the Red Hat Network. \n==========================================================================\nUbuntu Security Notice USN-3179-1\nJanuary 25, 2017\n\nopenjdk-8 vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 16.10\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in OpenJDK 8. \n\nSoftware Description:\n- openjdk-8: Open Source Java implementation\n\nDetails:\n\nKarthik Bhargavan and Gaetan Leurent discovered that the DES and\nTriple DES ciphers were vulnerable to birthday attacks. This update moves those algorithms to the\nlegacy algorithm set and causes them to be used only if no non-legacy\nalgorithms can be negotiated. (CVE-2016-2183)\n\nIt was discovered that OpenJDK accepted ECSDA signatures using\nnon-canonical DER encoding. An attacker could use this to modify or\nexpose sensitive data. (CVE-2016-5546)\n\nIt was discovered that OpenJDK did not properly verify object\nidentifier (OID) length when reading Distinguished Encoding Rules\n(DER) records, as used in x.509 certificates and elsewhere. An\nattacker could use this to cause a denial of service (memory\nconsumption). (CVE-2016-5547)\n\nIt was discovered that covert timing channel vulnerabilities existed\nin the DSA and ECDSA implementations in OpenJDK. A remote attacker\ncould use this to expose sensitive information. (CVE-2016-5548,\nCVE-2016-5549)\n\nIt was discovered that the URLStreamHandler class in OpenJDK did not\nproperly parse user information from a URL. A remote attacker could\nuse this to expose sensitive information. (CVE-2016-5552)\n\nIt was discovered that the URLClassLoader class in OpenJDK did not\nproperly check access control context when downloading class files. A\nremote attacker could use this to expose sensitive information. \n(CVE-2017-3231)\n\nIt was discovered that the Remote Method Invocation (RMI)\nimplementation in OpenJDK performed deserialization of untrusted\ninputs. A remote attacker could use this to execute arbitrary\ncode. (CVE-2017-3241)\n\nIt was discovered that the Java Authentication and Authorization\nService (JAAS) component of OpenJDK did not properly perform user\nsearch LDAP queries. An attacker could use a specially constructed\nLDAP entry to expose or modify sensitive information. (CVE-2017-3252)\n\nIt was discovered that the PNGImageReader class in OpenJDK did not\nproperly handle iTXt and zTXt chunks. An attacker could use this to\ncause a denial of service (memory consumption). (CVE-2017-3253)\n\nIt was discovered that integer overflows existed in the\nSocketInputStream and SocketOutputStream classes of OpenJDK. An\nattacker could use this to expose sensitive information. \n(CVE-2017-3261)\n\nIt was discovered that the atomic field updaters in the\njava.util.concurrent.atomic package in OpenJDK did not properly\nrestrict access to protected field members. An attacker could use\nthis to specially craft a Java application or applet that could bypass\nJava sandbox restrictions. (CVE-2017-3272)\n\nIt was discovered that a vulnerability existed in the class\nconstruction implementation in OpenJDK. An attacker could use this\nto specially craft a Java application or applet that could bypass\nJava sandbox restrictions. (CVE-2017-3289)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 16.10:\n openjdk-8-jdk 8u121-b13-0ubuntu1.16.10.2\n openjdk-8-jdk-headless 8u121-b13-0ubuntu1.16.10.2\n openjdk-8-jre 8u121-b13-0ubuntu1.16.10.2\n openjdk-8-jre-headless 8u121-b13-0ubuntu1.16.10.2\n openjdk-8-jre-jamvm 8u121-b13-0ubuntu1.16.10.2\n openjdk-8-jre-zero 8u121-b13-0ubuntu1.16.10.2\n\nUbuntu 16.04 LTS:\n openjdk-8-jdk 8u121-b13-0ubuntu1.16.04.2\n openjdk-8-jdk-headless 8u121-b13-0ubuntu1.16.04.2\n openjdk-8-jre 8u121-b13-0ubuntu1.16.04.2\n openjdk-8-jre-headless 8u121-b13-0ubuntu1.16.04.2\n openjdk-8-jre-jamvm 8u121-b13-0ubuntu1.16.04.2\n openjdk-8-jre-zero 8u121-b13-0ubuntu1.16.04.2\n\nThis update uses a new upstream release, which includes additional\nbug fixes. After a standard system update you need to restart any\nJava applications or applets to make all the necessary changes. \n\nRed Hat Quay is a secure, private container registry that builds, analyzes\nand distributes container images. It provides a high level of automation\nand customization. (CVE-2016-2183)\n\nBug Fix(es):\n\n* Running Quay in config mode now works in a disconnected option which\ndoesn\u0027t require pulling resources from the Internet. \n\n* Quay\u0027s security scan endpoint is now enabled at startup for viewing\nresults of Clair container image scans. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nNote: the current version of the following document is available here:\nhttps://softwaresupport.hpe.com/document/-/facetsearch/document/KM03158613\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: KM03158613\nVersion: 1\n\nMFSBGN03805 - HP Service Manager, Remote Disclosure of Information\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2018-05-10\nLast Updated: 2018-05-10\n\nPotential Security Impact: Remote: Disclosure of Information\n\nSource: Micro Focus, Product Security Response Team\n\nVULNERABILITY SUMMARY\nA potential security vulnerability has been identified in Service Manager. \nThis vulnerability may allow an exploit against a long-duration encrypted\nsession known as the Sweet32 attack, and which may be exploited remotely. \n\nReferences:\n\n - CVE-2016-2183\n - CVE-2016-6329\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \n\n - HP Service Manager Software - v9.30, v9.31, v9.32, v9.33, v9.34, v9.35,\nv9.40, v9.41, v9.50, v9.51\n\nBACKGROUND\n\n CVSS Base Metrics\n =================\n Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector\n\n\nRESOLUTION\n\nMicroFocus has made the following information available to resolve the\nvulnerability for the impacted versions of Service Manager:\n\nFor versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35 please upgrade to SM 9.35.P6:\n\nSM9.35 P6 packages,\nSM 9.35 AIX Server 9.35.6007 p6\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00916\u003e\n\nSM 9.35 HP Itanium Server 9.35.6007 p6\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00917\u003e\n\nSM 9.35 HP Itanium Server for Oracle 12c 9.35.6007 p6\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00918\u003e\n\nSM 9.35 Linux Server 9.35.6007 p6\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00919\u003e\n\nSM 9.35 Solaris Server 9.35.6007 p6\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00920\u003e\n\nSM 9.35 Windows Server 9.35.6007 p6\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00921\u003e\n\n\n\nFor version 9.40, 9.41 please upgrade to SM 9.41.P6:\n\nSM9.41.P6 packages,\nService Manager 9.41.6000 p6 - Server for AIX\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00891\u003e\n\nService Manager 9.41.6000 p6 - Server for HP-UX/IA\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00892\u003e\n\nService Manager 9.41.6000 p6 - Server for Linux\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00893\u003e\n\nService Manager 9.41.6000 p6 - Server for Solaris\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00894\u003e\n\nService Manager 9.41.6000 p6 - Server for Windows\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00895\u003e\n\nFor version 9.50, 9.51 Server and KM components please upgrade to SM 9.52.P2:\n\nSM9.52.P2 packages,\nService Manager 9.52.2021 p2 - Server for Windows\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00906\u003e\n\nService Manager 9.52.2021 p2 - Server for Linux\n\u003chttp://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-\nfacetsearch/document/LID/HPSM_00907\u003e\n\nFor version 9.50, 9.51 SMSP and SMC components please upgrade to SM 9.52:\n\nSM9.52 packages,\nService Manager 9.52 as a minor.minor full (MMF) release (due to the new SP\naggregation SKU for Propel customers) is released on the following sites\ninstead of SSO. \n\u003chttps://h22255.www2.hpe.com/mysoftware/index\u003e\n\nHISTORY\nVersion:1 (rev.1) - 10 May 2018 Initial release\n\nThird Party Security Patches: Third party security patches that are to be installed on \nsystems running Micro Focus products should be applied in accordance with the customer\u0027s \npatch management policy. \n\nSupport: For issues about implementing the recommendations of this Security Bulletin, contact normal Micro Focus services support channel. \nFor other issues about the content of this Security Bulletin, send e-mail to cyber-psrt@microfocus.com. \n\nReport: To report a potential security vulnerability for any supported product:\n Web form: https://www.microfocus.com/support-and-services/report-security\n Email: security@microfocus.com\n\nSubscribe:\n To initiate receiving subscriptions for future Micro Focus Security Bulletin alerts via Email, please subscribe here - https://softwaresupport.hpe.com/group/softwaresupport/email-notification/-/subscriptions/registerdocumentnotification\n Once you are logged in to the portal, please choose security bulletins under product and document types. \n Please note that you will need to sign in using a Passport account. If you do not have a Passport account yet, you can create one- its free and easy https://cf.passport.softwaregrp.com/hppcf/createuser.do \n\nSecurity Bulletin Archive:\n A list of recently released Security Bulletins is available here: https://softwaresupport.hpe.com/security-vulnerability\n \nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following Micro Focus Security Bulletin. \n\n3P = 3rd Party Software\nGN = Micro Focus General Software\nMU = Multi-Platform Software\n\nSystem management and security procedures must be reviewed frequently to maintain system integrity. \nMicro Focus is continually reviewing and enhancing the security features of software products to provide \ncustomers with current secure solutions. \n\n\"Micro Focus is broadly distributing this Security Bulletin in order to bring to the attention of users of the \naffected Micro Focus products the important security information contained in this Bulletin. Micro Focus recommends \nthat all users determine the applicability of this information to their individual situations and take appropriate action. \nMicro Focus does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, \nMicro Focus will not be responsible for any damages resulting from user\u0027s use or disregard of the information provided in \nthis Security Bulletin. To the extent permitted by law, Micro Focus disclaims all warranties, either express or \nimplied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement.\" \n\n\nCopyright 2017 EntIT Software LLC\n\nMicro Focus shall not be liable for technical or editorial errors or omissions contained herein. \nThe information provided is provided \"as is\" without warranty of any kind. To the extent permitted by law, \nneither Micro Focus nor its affiliates, subcontractors or suppliers will be liable for incidental, special \nor consequential damages including downtime cost; lost profits; damages relating to the procurement of \nsubstitute products or services; or damages for loss of data, or software restoration. \nThe information in this document is subject to change without notice. Micro Focus and the names of \nMicro Focus products referenced herein are trademarks of Micro Focus in the United States and other countries. \nOther product and company names mentioned herein may be trademarks of their respective owners. This software, such as Apache HTTP Server, is\ncommon to multiple JBoss middleware products, and is packaged under Red Hat\nJBoss Core Services to allow for faster distribution of updates, and for a\nmore consistent update experience. \n\nThis release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23\nService Pack 2 serves as an update for Red Hat JBoss Core Services Apache\nHTTP Server 2.4.23 Service Pack 1, and includes bug fixes, which are\ndocumented in the Release Notes document linked to in the References. \n\nSecurity Fix(es):\n\n* It was discovered that the httpd\u0027s mod_auth_digest module did not\nproperly initialize memory before using it when processing certain headers\nrelated to digest authentication. A remote attacker could possibly use this\nflaw to disclose potentially sensitive information or cause httpd child\nprocess to crash by sending specially crafted requests to a server. \n(CVE-2017-9788)\n\n* It was discovered that in httpd 2.4, the internal API function\nap_some_auth_required() could incorrectly indicate that a request was\nauthenticated even when no authentication was used. An httpd module using\nthis API function could consequently allow access that should have been\ndenied. JIRA issues fixed (https://issues.jboss.org/):\n\nJBCS-329 - Unable to load large CRL openssl problem\n\n6",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-2183"
},
{
"db": "VULHUB",
"id": "VHN-91002"
},
{
"db": "PACKETSTORM",
"id": "154650"
},
{
"db": "PACKETSTORM",
"id": "148410"
},
{
"db": "PACKETSTORM",
"id": "141353"
},
{
"db": "PACKETSTORM",
"id": "140977"
},
{
"db": "PACKETSTORM",
"id": "156451"
},
{
"db": "PACKETSTORM",
"id": "140718"
},
{
"db": "PACKETSTORM",
"id": "152978"
},
{
"db": "PACKETSTORM",
"id": "147581"
},
{
"db": "PACKETSTORM",
"id": "144134"
}
],
"trust": 1.8
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-91002",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-91002"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-2183",
"trust": 2.0
},
{
"db": "PACKETSTORM",
"id": "142756",
"trust": 1.1
},
{
"db": "ICS CERT",
"id": "ICSMA-18-058-02",
"trust": 1.1
},
{
"db": "SECTRACK",
"id": "1036696",
"trust": 1.1
},
{
"db": "PULSESECURE",
"id": "SA40312",
"trust": 1.1
},
{
"db": "BID",
"id": "92630",
"trust": 1.1
},
{
"db": "BID",
"id": "95568",
"trust": 1.1
},
{
"db": "TENABLE",
"id": "TNS-2017-09",
"trust": 1.1
},
{
"db": "TENABLE",
"id": "TNS-2016-21",
"trust": 1.1
},
{
"db": "TENABLE",
"id": "TNS-2016-20",
"trust": 1.1
},
{
"db": "TENABLE",
"id": "TNS-2016-16",
"trust": 1.1
},
{
"db": "MCAFEE",
"id": "SB10197",
"trust": 1.1
},
{
"db": "MCAFEE",
"id": "SB10310",
"trust": 1.1
},
{
"db": "MCAFEE",
"id": "SB10186",
"trust": 1.1
},
{
"db": "MCAFEE",
"id": "SB10215",
"trust": 1.1
},
{
"db": "MCAFEE",
"id": "SB10171",
"trust": 1.1
},
{
"db": "SIEMENS",
"id": "SSA-412672",
"trust": 1.1
},
{
"db": "JUNIPER",
"id": "JSA10759",
"trust": 1.1
},
{
"db": "EXPLOIT-DB",
"id": "42091",
"trust": 1.1
},
{
"db": "PACKETSTORM",
"id": "148410",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "140718",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "156451",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "147581",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "152978",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "140977",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "154650",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "141353",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "161320",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "141352",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "140708",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "143970",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "150303",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "143244",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "141100",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "140473",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "141111",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "141354",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144865",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "143549",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "141555",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "140725",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144869",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "142340",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "145017",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "140084",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "145018",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "159431",
"trust": 0.1
},
{
"db": "CNNVD",
"id": "CNNVD-201608-448",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-91002",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144134",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-91002"
},
{
"db": "PACKETSTORM",
"id": "154650"
},
{
"db": "PACKETSTORM",
"id": "148410"
},
{
"db": "PACKETSTORM",
"id": "141353"
},
{
"db": "PACKETSTORM",
"id": "140977"
},
{
"db": "PACKETSTORM",
"id": "156451"
},
{
"db": "PACKETSTORM",
"id": "140718"
},
{
"db": "PACKETSTORM",
"id": "152978"
},
{
"db": "PACKETSTORM",
"id": "147581"
},
{
"db": "PACKETSTORM",
"id": "144134"
},
{
"db": "NVD",
"id": "CVE-2016-2183"
}
]
},
"id": "VAR-201609-0597",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-91002"
}
],
"trust": 0.01
},
"last_update_date": "2024-09-19T19:25:33.032000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-91002"
},
{
"db": "NVD",
"id": "CVE-2016-2183"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://access.redhat.com/security/cve/cve-2016-2183"
},
{
"trust": 1.2,
"url": "http://rhn.redhat.com/errata/rhsa-2017-0338.html"
},
{
"trust": 1.2,
"url": "https://access.redhat.com/errata/rhsa-2017:2708"
},
{
"trust": 1.2,
"url": "https://access.redhat.com/errata/rhsa-2018:2123"
},
{
"trust": 1.2,
"url": "https://access.redhat.com/errata/rhsa-2019:1245"
},
{
"trust": 1.2,
"url": "https://access.redhat.com/errata/rhsa-2019:2859"
},
{
"trust": 1.2,
"url": "https://access.redhat.com/errata/rhsa-2020:0451"
},
{
"trust": 1.2,
"url": "http://www.ubuntu.com/usn/usn-3179-1"
},
{
"trust": 1.2,
"url": "http://www.ubuntu.com/usn/usn-3194-1"
},
{
"trust": 1.2,
"url": "https://access.redhat.com/articles/2548661"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1036696"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/539885/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/archive/1/539885/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/archive/1/540129/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/540341/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/archive/1/540341/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://seclists.org/fulldisclosure/2017/may/105"
},
{
"trust": 1.1,
"url": "http://seclists.org/fulldisclosure/2017/jul/31"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/541104/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/archive/1/541104/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/542005/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/archive/1/542005/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://seclists.org/bugtraq/2018/nov/21"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/42091/"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/92630"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/95568"
},
{
"trust": 1.1,
"url": "http://www.debian.org/security/2016/dsa-3673"
},
{
"trust": 1.1,
"url": "https://security.gentoo.org/glsa/201612-16"
},
{
"trust": 1.1,
"url": "https://security.gentoo.org/glsa/201701-65"
},
{
"trust": 1.1,
"url": "https://security.gentoo.org/glsa/201707-01"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2017-0336.html"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2017-0337.html"
},
{
"trust": 1.1,
"url": "http://rhn.redhat.com/errata/rhsa-2017-0462.html"
},
{
"trust": 1.1,
"url": "https://access.redhat.com/errata/rhsa-2017:1216"
},
{
"trust": 1.1,
"url": "https://access.redhat.com/errata/rhsa-2017:2709"
},
{
"trust": 1.1,
"url": "https://access.redhat.com/errata/rhsa-2017:2710"
},
{
"trust": 1.1,
"url": "https://access.redhat.com/errata/rhsa-2017:3113"
},
{
"trust": 1.1,
"url": "https://access.redhat.com/errata/rhsa-2017:3114"
},
{
"trust": 1.1,
"url": "https://access.redhat.com/errata/rhsa-2017:3239"
},
{
"trust": 1.1,
"url": "https://access.redhat.com/errata/rhsa-2017:3240"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00023.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00028.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00076.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html"
},
{
"trust": 1.1,
"url": "http://www.ubuntu.com/usn/usn-3087-1"
},
{
"trust": 1.1,
"url": "http://www.ubuntu.com/usn/usn-3087-2"
},
{
"trust": 1.1,
"url": "http://www.ubuntu.com/usn/usn-3198-1"
},
{
"trust": 1.1,
"url": "http://www.ubuntu.com/usn/usn-3270-1"
},
{
"trust": 1.1,
"url": "http://www.ubuntu.com/usn/usn-3372-1"
},
{
"trust": 1.1,
"url": "https://www.ietf.org/mail-archive/web/tls/current/msg04560.html"
},
{
"trust": 1.1,
"url": "http://packetstormsecurity.com/files/142756/ibm-informix-dynamic-server-dll-injection-code-execution.html"
},
{
"trust": 1.1,
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8n1021697"
},
{
"trust": 1.1,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21991482"
},
{
"trust": 1.1,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995039"
},
{
"trust": 1.1,
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en"
},
{
"trust": 1.1,
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
},
{
"trust": 1.1,
"url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
},
{
"trust": 1.1,
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"trust": 1.1,
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"trust": 1.1,
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"trust": 1.1,
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"trust": 1.1,
"url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html"
},
{
"trust": 1.1,
"url": "http://www.splunk.com/view/sp-caaapsv"
},
{
"trust": 1.1,
"url": "http://www.splunk.com/view/sp-caaapue"
},
{
"trust": 1.1,
"url": "https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/"
},
{
"trust": 1.1,
"url": "https://bto.bluecoat.com/security-advisory/sa133"
},
{
"trust": 1.1,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1369383"
},
{
"trust": 1.1,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
},
{
"trust": 1.1,
"url": "https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05302448"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05309984"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05323116"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05349499"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05356388"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05369403"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05369415"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05385680"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05390722"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05390849"
},
{
"trust": 1.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-058-02"
},
{
"trust": 1.1,
"url": "https://kb.pulsesecure.net/articles/pulse_security_advisories/sa40312"
},
{
"trust": 1.1,
"url": "https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/"
},
{
"trust": 1.1,
"url": "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/"
},
{
"trust": 1.1,
"url": "https://security.netapp.com/advisory/ntap-20160915-0001/"
},
{
"trust": 1.1,
"url": "https://security.netapp.com/advisory/ntap-20170119-0001/"
},
{
"trust": 1.1,
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/km03158613"
},
{
"trust": 1.1,
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/km03286178"
},
{
"trust": 1.1,
"url": "https://support.f5.com/csp/article/k13167034"
},
{
"trust": 1.1,
"url": "https://sweet32.info/"
},
{
"trust": 1.1,
"url": "https://wiki.opendaylight.org/view/security_advisories"
},
{
"trust": 1.1,
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24"
},
{
"trust": 1.1,
"url": "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008"
},
{
"trust": 1.1,
"url": "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/"
},
{
"trust": 1.1,
"url": "https://www.openssl.org/blog/blog/2016/08/24/sweet32/"
},
{
"trust": 1.1,
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"trust": 1.1,
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"trust": 1.1,
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"trust": 1.1,
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"trust": 1.1,
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"trust": 1.1,
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"trust": 1.1,
"url": "https://www.sigsac.org/ccs/ccs2016/accepted-papers/"
},
{
"trust": 1.1,
"url": "https://www.tenable.com/security/tns-2016-16"
},
{
"trust": 1.1,
"url": "https://www.tenable.com/security/tns-2016-20"
},
{
"trust": 1.1,
"url": "https://www.tenable.com/security/tns-2016-21"
},
{
"trust": 1.1,
"url": "https://www.tenable.com/security/tns-2017-09"
},
{
"trust": 1.1,
"url": "https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00003.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00032.html"
},
{
"trust": 1.1,
"url": "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html"
},
{
"trust": 1.0,
"url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10759"
},
{
"trust": 1.0,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-c05302448"
},
{
"trust": 1.0,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-c05369403"
},
{
"trust": 1.0,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-c05369415"
},
{
"trust": 1.0,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-c05385680"
},
{
"trust": 1.0,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-c05390722"
},
{
"trust": 1.0,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-c05390849"
},
{
"trust": 1.0,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbgn03765en_us"
},
{
"trust": 1.0,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbux03725en_us"
},
{
"trust": 1.0,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10171"
},
{
"trust": 1.0,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10186"
},
{
"trust": 1.0,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10197"
},
{
"trust": 1.0,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10215"
},
{
"trust": 1.0,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10310"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-2183"
},
{
"trust": 0.6,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.6,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3253"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5546"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3261"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3241"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3231"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5552"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3252"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3272"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5548"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5549"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5547"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3289"
},
{
"trust": 0.1,
"url": "http://kb.juniper.net/infocenter/index?page=content\u0026amp;id=jsa10759"
},
{
"trust": 0.1,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-c05302448"
},
{
"trust": 0.1,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-c05369403"
},
{
"trust": 0.1,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-c05369415"
},
{
"trust": 0.1,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-c05385680"
},
{
"trust": 0.1,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-c05390722"
},
{
"trust": 0.1,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-c05390849"
},
{
"trust": 0.1,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-hpesbgn03765en_us"
},
{
"trust": 0.1,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-hpesbux03725en_us"
},
{
"trust": 0.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10171"
},
{
"trust": 0.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10186"
},
{
"trust": 0.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10197"
},
{
"trust": 0.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10215"
},
{
"trust": 0.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10310"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-rel"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-3231"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-3259"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-5548"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-5549"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-3253"
},
{
"trust": 0.1,
"url": "https://developer.ibm.com/javasdk/support/security-vulnerabilities/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-3252"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-3259"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-5552"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-3272"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-3241"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-5546"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-3261"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-7/7u121-2.6.8-1ubuntu0.14.04.3"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-13734"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-13734"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/11258."
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-8/8u121-b13-0ubuntu1.16.04.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openjdk-8/8u121-b13-0ubuntu1.16.10.2"
},
{
"trust": 0.1,
"url": "https://www.microfocus.com/support-and-services/report-security"
},
{
"trust": 0.1,
"url": "https://softwaresupport.hpe.com/group/softwaresupport/email-notification/-/subscriptions/registerdocumentnotification"
},
{
"trust": 0.1,
"url": "https://h22255.www2.hpe.com/mysoftware/index\u003e"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-6329"
},
{
"trust": 0.1,
"url": "https://cf.passport.softwaregrp.com/hppcf/createuser.do"
},
{
"trust": 0.1,
"url": "https://softwaresupport.hpe.com/security-vulnerability"
},
{
"trust": 0.1,
"url": "http://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/-"
},
{
"trust": 0.1,
"url": "https://softwaresupport.hpe.com/document/-/facetsearch/document/km03158613"
},
{
"trust": 0.1,
"url": "https://issues.jboss.org/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2015-3185"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en/red-hat-jboss-core-services/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-3185"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.apachehttp\u0026downloadtype=securitypatches\u0026version=2.4.23"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-9788"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9788"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#important"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-91002"
},
{
"db": "PACKETSTORM",
"id": "154650"
},
{
"db": "PACKETSTORM",
"id": "148410"
},
{
"db": "PACKETSTORM",
"id": "141353"
},
{
"db": "PACKETSTORM",
"id": "140977"
},
{
"db": "PACKETSTORM",
"id": "156451"
},
{
"db": "PACKETSTORM",
"id": "140718"
},
{
"db": "PACKETSTORM",
"id": "152978"
},
{
"db": "PACKETSTORM",
"id": "147581"
},
{
"db": "PACKETSTORM",
"id": "144134"
},
{
"db": "NVD",
"id": "CVE-2016-2183"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-91002"
},
{
"db": "PACKETSTORM",
"id": "154650"
},
{
"db": "PACKETSTORM",
"id": "148410"
},
{
"db": "PACKETSTORM",
"id": "141353"
},
{
"db": "PACKETSTORM",
"id": "140977"
},
{
"db": "PACKETSTORM",
"id": "156451"
},
{
"db": "PACKETSTORM",
"id": "140718"
},
{
"db": "PACKETSTORM",
"id": "152978"
},
{
"db": "PACKETSTORM",
"id": "147581"
},
{
"db": "PACKETSTORM",
"id": "144134"
},
{
"db": "NVD",
"id": "CVE-2016-2183"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-09-01T00:00:00",
"db": "VULHUB",
"id": "VHN-91002"
},
{
"date": "2019-09-28T14:44:44",
"db": "PACKETSTORM",
"id": "154650"
},
{
"date": "2018-07-03T14:44:44",
"db": "PACKETSTORM",
"id": "148410"
},
{
"date": "2017-02-28T14:19:11",
"db": "PACKETSTORM",
"id": "141353"
},
{
"date": "2017-02-08T19:22:00",
"db": "PACKETSTORM",
"id": "140977"
},
{
"date": "2020-02-20T21:09:43",
"db": "PACKETSTORM",
"id": "156451"
},
{
"date": "2017-01-25T21:53:38",
"db": "PACKETSTORM",
"id": "140718"
},
{
"date": "2019-05-20T16:39:06",
"db": "PACKETSTORM",
"id": "152978"
},
{
"date": "2018-05-10T23:26:00",
"db": "PACKETSTORM",
"id": "147581"
},
{
"date": "2017-09-14T19:44:18",
"db": "PACKETSTORM",
"id": "144134"
},
{
"date": "2016-09-01T00:59:00.137000",
"db": "NVD",
"id": "CVE-2016-2183"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-02-12T00:00:00",
"db": "VULHUB",
"id": "VHN-91002"
},
{
"date": "2023-02-12T23:17:38.140000",
"db": "NVD",
"id": "CVE-2016-2183"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "140977"
},
{
"db": "PACKETSTORM",
"id": "140718"
}
],
"trust": 0.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat Security Advisory 2019-2859-01",
"sources": [
{
"db": "PACKETSTORM",
"id": "154650"
}
],
"trust": 0.1
}
}
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.