Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 4 articles for you...
100
security advisorySuSEimportantSUSE Tomcat 9.0.115 Important Certificate Issues Advisory 2026-0932-1
An update that solves three vulnerabilities can now be installed.. # Security update for tomcat Announcement ID: SUSE-SU-2026:0932-1 Release Date: 2026-03-19T10:27:34Z Rating: important References: * bsc#1258371 * bsc#1258385 * bsc#1258387 Cross-References: * CVE-2025-66614 * CVE-2026-24733 * CVE-2026-24734 CVSS scores: * CVE-2025-66614 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2025-66614 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2025-66614 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L * CVE-2026-24733 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24733 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24733 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24733 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24734 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-24734 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-24734 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * Web and Scripting Module 15-SP7 An update that solves three vulnerabilities can now be installed. ## Description: This update for tomcat fixes the following issues: Update to Tomcat 9.0.115: * CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371). * CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385). * CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387). Changelog: * Catalina * Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt) * Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz) * Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis) * Update: Update the minimum and recommended versions for Tomcat Native to 1.3.4. (markt) * Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt) * Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt) * Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm) * Fix: Add log warnings for additional Host appBase suspicious values. (remm) * Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt) * Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt) * Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt) * Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt) * Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm) * Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt) * Cluster * Add: 62814: Document that human-readable names maybe used for mapSendOptions and align documentation with channelSendOptions. Based on pull request #929 by archan0621. (markt) * Clustering * Fix: Correct a regression introduced in 9.0.109 that broke some clustering configurations. (markt) * Coyote * Fix: Prevent concurrent release of OpenSSLEngine resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown. (markt) * Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm) * Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring the tomcat-native changes. (remm) * Fix: 69910: Dereference TLS objects right after closing a socket to improve memory efficiency. (remm) * Fix: Relax the JSSE vs OpenSSLconfiguration style checks on SSLHostConfig to reflect the existing implementation that allows one configuration style to be used for the trust attributes and a different style for all the other attributes. (markt) * Fix: Better warning message when OpenSSLConf configuration elements are used with a JSSE TLS implementation. (markt) * Fix: When using OpenSSL via FFM, don't log a warning about missing CA certificates unless CA certificates were configured and the configuration failed. (markt) * Add: For configuration consistency between OpenSSL and JSSE TLS implementations, TLSv1.3 cipher suites included in the ciphers attribute of an SSLHostConfig are now always ignored (previously they would be ignored with OpenSSL implementations and used with JSSE implementations) and a warning is logged that the cipher suite has been ignored. (markt) * Add: Add the ciphersuite attribute to SSLHostConfig to configure the TLSv1.3 cipher suites. (markt) * Add: Add OCSP support to JSSE based TLS connectors and make the use of OCSP configurable per connector for both JSSE and OpenSSL based TLS implementations. Align the checks performed by OpenSSL with those performed by JSSE. (markt) * Add: Add support for soft failure of OCSP checks with soft failure support disabled by default. (markt) * Add: Add support for configuring the verification flags passed to OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt) * Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5. * Fix: Don't log an incorrect certificate KeyStore location when creating a TLS connector if the KeyStore instance has been set directly on the connector. (markt) * Fix: HTTP/0.9 only allows GET as the HTTP method. (remm) * Add: Add strictSni attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true, enabling the matching. (remm) * Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm) * Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL provider. Pull request #912 by aogburn. (markt) * Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers. * Jasper * Fix: 69333: Correct a regression in the previous fix for 69333 and ensure that reuse() or release() is always called for a tag. (markt) * Fix: 69877: Catch IllegalArgumentException when processing URIs when creating the classpath to handle invalid URIs. (remm) * Fix: Fix populating the classpath with the webapp classloader repositories. (remm) * Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some exception details. Patch submitted by Eric Blanquer. (remm) * Jdbc-pool * Fix: 64083: If the underlying connection has been closed, don't add it to the pool when it is returned. Pull request #235 by Alex Panchenko. (markt) * Web applications * Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server status output if one or more of the web applications failed to start. (schultz) * Add: Manager: Include web application state in the HTML and JSON complete server status output. (markt) * Add: Documentation: Expand the documentation to better explain when OCSP is supported and when it is not. (markt) * Websocket * Fix: 69920: When attempting to write to a closed Writer or OutputStream obtained from a WebSocket session, throw an IOException rather than an IllegalStateExcpetion as required by Writer and strongly suggested by OutputStream. (markt) * Other * Add: Add property "gpg.sign.files" to optionally disable release artefact signing with GPG. (rjung) * Add: Add test.silent property to suppress JUnit console output during test execution. Useful for cleaner console output when runningtests with multiple threads. (csutherl) * Update: Update the internal fork of Commons Pool to 2.13.1. (markt) * Update: Update the internal fork of Commons DBCP to 2.14.0. (markt) * Update: Update Commons Daemon to 1.5.1. (markt) * Update: Update ByteBuddy to 1.18.3. (markt) * Update: Update UnboundID to 7.0.4. (markt) * Update: Update Checkstyle to 12.3.1. (markt) * Add: Improvements to French translations. (markt) * Add: Improvements to Japanese translations provided by tak7iji. (markt) * Add: Improvements to Chinese translations provided by Yang. vincent.h and yong hu. (markt) * Update: Update Tomcat Native to 1.3.5. (markt) * Add: Add test profile system for selective test execution. Profiles can be specified via -Dtest.profile= to run specific test subsets without using patterns directly. Profile patterns are defined in test- profiles.properties. (csutherl) * Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt) * Update: Update Commons Daemon to 1.5.0. (markt) * Update: Update Byte Buddy to 1.18.2. (markt) * Update: Update Checkstyle to 12.2.0. (markt) * Add: Improvements to Spanish translations provided by White Vogel. (markt) * Add: Improvements to French translations. (remm) * Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt) * Update: Update to Byte Buddy 1.17.8. (markt) * Update: Update to Checkstyle 12.1.1. (markt) * Update: Update to Jacoco 0.8.14. (markt) * Update: Update to SpotBugs 4.9.8. (markt) * Update: Update to JSign 7.4. (markt) * Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-932=1 * Web and Scripting Module 15-SP7 zypper in-t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-932=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-932=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-932=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-932=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-932=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-932=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-932=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-932=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-932=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-932=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-932=1 ## Package List: * openSUSE Leap 15.6 (noarch) * tomcat-embed-9.0.115-150200.102.1 * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-javadoc-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-jsvc-9.0.115-150200.102.1 * tomcat-docs-webapp-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * Web and Scripting Module 15-SP7 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 *tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSELinux Enterprise Server 15 SP5 LTSS (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 ## References: * https://www.suse.com/security/cve/CVE-2025-66614.html * https://www.suse.com/security/cve/CVE-2026-24733.html * https://www.suse.com/security/cve/CVE-2026-24734.html *https://bugzilla.suse.com/show_bug.cgi?id=1258371 * https://bugzilla.suse.com/show_bug.cgi?id=1258385 * https://bugzilla.suse.com/show_bug.cgi?id=1258387 . SUSE security advisory details important Tomcat updates fixing input validation bypass and certificate issues.. SUSE Tomcat important update, security advisory Tomcat, input validation issues. . Severity: Important. LinuxSecurity.com Team
Mar 19, 2026
•Important
SuSE
203
security advisorysecurity issuecriticalMageia 7: MGASA-2021-0284 Critical: Stunnel Client Certificate Issue
Updated stunnel package fixes security vulnerability: Client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230). . MGASA-2021-0284 - Updated tunnel packages fix security vulnerability Publication date: 23 Jun 2021 URL: https://advisories.mageia.org/MGASA-2021-0284.html Type: security Affected Mageia releases: 7 CVE: CVE-2021-20230 Updated stunnel package fixes security vulnerability: Client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230). References: - https://bugs.mageia.org/show_bug.cgi?id=28195 - https://access.redhat.com/errata/RHSA-2021:0618 - https://www.cve.org/CVERecord?id=CVE-2021-20230 SRPMS: - 7/core/stunnel-5.57-1.mga7 . Recent upgrades to the tunnel module address problems with client cert validation; essential for Mageia users.. stunnel Update, Mageia Security, Client Certificate Fixes, Tunnel Security Alerts. . Severity: Critical. LinuxSecurity.com Team
Jun 23, 2021
•Critical
Mageia
98
security advisorynetwork securitysecurity issueRed Hat 8: RHSA-2021-0618-01 Important: Stunnel Client Certificate Issue
An update for stunnel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: stunnel security update Advisory ID: RHSA-2021:0618-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:0618 Issue date: 2021-02-22 CVE Names: CVE-2021-20230 ==================================================================== 1. Summary: An update for stunnel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over an encrypted connection (encrypted using SSL or TLS) or to provide an encrypted means of connecting to services that do not natively support encryption. Security Fix(es): * stunnel: client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed(https://bugzilla.redhat.com/): 1925226 - CVE-2021-20230 stunnel: client certificate not correctly verified when redirect and verifyChain options are used 6. Package List: Red Hat Enterprise Linux BaseOS (v. 8): Source: stunnel-5.56-5.el8_3.src.rpm aarch64: stunnel-5.56-5.el8_3.aarch64.rpm stunnel-debuginfo-5.56-5.el8_3.aarch64.rpm stunnel-debugsource-5.56-5.el8_3.aarch64.rpm ppc64le: stunnel-5.56-5.el8_3.ppc64le.rpm stunnel-debuginfo-5.56-5.el8_3.ppc64le.rpm stunnel-debugsource-5.56-5.el8_3.ppc64le.rpm s390x: stunnel-5.56-5.el8_3.s390x.rpm stunnel-debuginfo-5.56-5.el8_3.s390x.rpm stunnel-debugsource-5.56-5.el8_3.s390x.rpm x86_64: stunnel-5.56-5.el8_3.x86_64.rpm stunnel-debuginfo-5.56-5.el8_3.x86_64.rpm stunnel-debugsource-5.56-5.el8_3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-20230 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYDOHXdzjgjWX9erEAQgJHA//XO6gs71FL1/5O9e3ckFV4QkIKF8Z2d+f rQwSmpcelOEYGV5q56EF7cZV7MhunQcXVia8gBXdZMSA9liPBNR7b3VXgYrmPHgk /6nU/2IkvxT6GwZBchAO0DQlXvD7TUZGQmoI0llmvHBrj93BG3WeoSi4hQIauBLZ tuGhH8euKCNwX/XJJ+7V5t7JjWDE5FzGFMcfw6i/DO6hhn47f1IOeUz+TH3iXRpd uvE1aF9TMcctKn3jQj7w/7Uf0UCpBpOa32SKKRmjMrtExmHSTJJ3tM7c0xgGEg35 w4h6PEeUHc5x4aWM9fNZcWaPAyPgNPj925DMYRVlVM2L6O3HiNPojwnZNSHJ9YS5 MYeTQikLN7Gbkt+MM1JOusLn00oOxgmYXEjTnaallKwDrWw5U2SwuH333ISRmlvb Mm+0j+G/91flDDxg1kCIeC39eSnn7sAcn6CucJV52HLgQbevtEwKSpnrqlg/TWh7 c02PGOoGK7hVKGTxddMrMT/PxIfCKzonJhvqn+pxujb6T8c5cl6HC+cJEEfaNl9e AzaI5/0d9jx4I46A7azHlp35vW5a+CbNq0mocN7JRW3QgqXZgrghgazeCs5lOBte RCWzLdPHbwjohTfu2lxymvzUb9aU9HlQnnCyeGLPuUnafaHCkyDeW/OjtY2jeV5r rsEhsbXmB+4=Zo9I -----END PGPSIGNATURE----- -- RHSA-announce mailing list
Feb 22, 2021
•Important
Red Hat
98
security advisoryRed Hatsecurity fixRed Hat 8.1 RHSA-2021:0620-01 Important: Stunnel Client Cert Fix
An update for stunnel is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: stunnel security update Advisory ID: RHSA-2021:0620-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:0620 Issue date: 2021-02-22 CVE Names: CVE-2021-20230 ==================================================================== 1. Summary: An update for stunnel is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS EUS (v. 8.1) - aarch64, ppc64le, s390x, x86_64 3. Description: Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over an encrypted connection (encrypted using SSL or TLS) or to provide an encrypted means of connecting to services that do not natively support encryption. Security Fix(es): * stunnel: client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed(https://bugzilla.redhat.com/): 1925226 - CVE-2021-20230 stunnel: client certificate not correctly verified when redirect and verifyChain options are used 6. Package List: Red Hat Enterprise Linux BaseOS EUS (v. 8.1): Source: stunnel-5.48-6.el8_1.src.rpm aarch64: stunnel-5.48-6.el8_1.aarch64.rpm stunnel-debuginfo-5.48-6.el8_1.aarch64.rpm stunnel-debugsource-5.48-6.el8_1.aarch64.rpm ppc64le: stunnel-5.48-6.el8_1.ppc64le.rpm stunnel-debuginfo-5.48-6.el8_1.ppc64le.rpm stunnel-debugsource-5.48-6.el8_1.ppc64le.rpm s390x: stunnel-5.48-6.el8_1.s390x.rpm stunnel-debuginfo-5.48-6.el8_1.s390x.rpm stunnel-debugsource-5.48-6.el8_1.s390x.rpm x86_64: stunnel-5.48-6.el8_1.x86_64.rpm stunnel-debuginfo-5.48-6.el8_1.x86_64.rpm stunnel-debugsource-5.48-6.el8_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-20230 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYDOHQtzjgjWX9erEAQiX5w//fSp7muESFK0MFGna8G7hlPxBPiX3MGaT ccN+guyedREQKDkJbzcGj0IKmoajDZbiaE6DjpxqV3sUUZhI0yM3f3YHqBlLTZAa OulNwCZwOhmixUOVdm+9vG1xyPXFm7D5IiiGF8Cfkb5jheD5NhL1ZzVXVuNm2Sup 2EcR0Iv6OwRdVbJWlgYqrrKSzpCRsbssvzDM1erjqirrGx6VdYM6TB8EjXMZpqBi 5g3ajGiEKo3IJduvv6sk6lYtfr7qCU6zeZE1K3+Jn+PMurACKGQcb6UW/7IxEOY6 zaN4NWFBm0CrQSAzjqA/Cie7yK5c6RM3AGC231DjWSJwcL9gCstTTX8UGx/ci9J1 3x18RVpUJJ+6ulI2blp+oslYGVeIsuKFiF6ffUm5KNPQjQqDIHaRC3j5d6aL0LVA I16mUyVUb6xQ0hLgHZqYWBlbrWs1Pmv1mhlOfmUn+fSWBpWv8Dq6iY8zBrQXz9d5 suIna+6YhXPpvEmt57N4X59X37tNRaCm7XX8Q59gwMTYE/kdwYpzEfwd8pW3/vlQ 8TLWYpP2If/X+98XWHFvvdP8bbEWOjfAXQxs52znSNlYz0blzw/aUqfm14IqkNg8 HBnfdHxPZh/xon6GozoLhh67DT/aK/FGE3LHKbt3RQQBoBc1OYhMwLZWAPwsYt6Q /ohUy1hMz1I=evFH -----END PGPSIGNATURE----- -- RHSA-announce mailing list
Feb 22, 2021
•Important
Red Hat
203
security advisoryupdateproftpdMageia: 2019-0385 Moderate: ProFTPD TLS Client Certificate Issue
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server . MGASA-2019-0385 - Updated proftpd packages fix security vulnerability Publication date: 13 Dec 2019 URL: https://advisories.mageia.org/MGASA-2019-0385.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-19269 An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurswhen validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup (CVE-2019-19269). References: - https://bugs.mageia.org/show_bug.cgi?id=25844 - https://lists.debian.org/debian-lts-announce/2019/11/msg00039.html - https://www.cve.org/CVERecord?id=CVE-2019-19269 SRPMS: - 7/core/proftpd-1.3.5e-4.2.mga7 . Recently released ProFTPD updates tackle a significant security vulnerability related to TLS client authentication in Mageia. Discover additional details.. Mageia Security, ProFTPD Update, TLS Client Validation. . LinuxSecurity.com Team
Dec 13, 2019
Mageia
98
security advisorymoderatesecurity fixOpenStack 14.0 RHSA-2019-3743-01 Security Update for Octavia Moderate
An update for openstack-octavia is now available for Red Hat OpenStack Platform 14.0 (Rocky). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which . -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: openstack-octavia security update Advisory ID: RHSA-2019:3743-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2019:3743 Issue date: 2019-11-06 CVE Names: CVE-2019-17134 ==================================================================== 1. Summary: An update for openstack-octavia is now available for Red Hat OpenStack Platform 14.0 (Rocky). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 14.0 - noarch, ppc64le, x86_64 3. Description: The OpenStack Load Balancing service (openstack-octavia) provides a Load Balancing-as-a-Service (LBaaS) version 2 implementation for Red Hat OpenStack platform director based installations. Security Fix(es): * openstack-octavia: amphora-agent not requiring client certificate (CVE-2019-17134) For more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1761307 - CVE-2019-17134openstack-octavia: amphora-agent not requiring client certificate 1762807 - Rebase openstack-octavia to 3.2.0 6. Package List: Red Hat OpenStack Platform 14.0: Source: openstack-octavia-3.1.0-3.el7ost.src.rpm noarch: openstack-octavia-amphora-agent-3.1.0-3.el7ost.noarch.rpm openstack-octavia-api-3.1.0-3.el7ost.noarch.rpm openstack-octavia-common-3.1.0-3.el7ost.noarch.rpm openstack-octavia-diskimage-create-3.1.0-3.el7ost.noarch.rpm openstack-octavia-health-manager-3.1.0-3.el7ost.noarch.rpm openstack-octavia-housekeeping-3.1.0-3.el7ost.noarch.rpm openstack-octavia-worker-3.1.0-3.el7ost.noarch.rpm python-octavia-3.1.0-3.el7ost.noarch.rpm ppc64le: openstack-octavia-debuginfo-3.1.0-3.el7ost.ppc64le.rpm python-octavia-tests-golang-3.1.0-3.el7ost.ppc64le.rpm x86_64: openstack-octavia-debuginfo-3.1.0-3.el7ost.x86_64.rpm python-octavia-tests-golang-3.1.0-3.el7ost.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-17134 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE-----Version: GnuPGv1 iQIVAwUBXcLk49zjgjWX9erEAQhOrBAAoxHewFVjcgKP7LWN2K8LPqrEbdwpPZ5f IHTSAtpHC8JeFN3RzCpxBR1j9kbEoormIAGKl+2axIPb57giAt5AuZ5pVFuazJpQ XU+0SzJRKs23sQbAtzXLcicGRnM1398VO4/gfy4FdBChcNOLlU0y8WPHKgWd+LmQ cIs7PA/H/8P9l+eH0AYHg0xqvNLumGKPkgVBGmA4s8NIzjCZTAUjXvJW0NS+JBAC 9A8yyDmE7pvlvRAzmZ0qWYnLHFHdDq4DF8Ydmg2tigf1SaDZAF9csh83M2vqXv9d ZoWfSs4AZhFy2SJNeXfpOT77tz0oQk8SSpHNA+ErnPfnVi1aDXeQze2ivSUeaVVQ C2jXyBc83ByKQGf84qdR1ZpgGtw0YjR75D4xISQlQsE7NiFnMT0n/SEChhFWJrEN yBR/Hp8I1iq5QOTatOHA5/6CGJav+WoIQdeYcUgOfTryHzv5+kbwtD9WsTWxiwfz jmtJ4KaRcVaVmyzYnctQwFioz+gwlgWbmWjzV+gQ98CpxlmPlVJW3OGY42vnNRvt yNonifiAxkcP25bsacZ9lA2uNQW5ni9ee9JcmNivgbqz8qdPi82OgzByqzrzjbS7 Gq7yPlybq6n54JGr5bSBrBr7/Rl/svHASYO98VKG/C5fReBuySABPblIWcAWmFjO TBi+VhrB2RM=jEXf -----END PGP SIGNATURE-------RHSA-announce mailing list
Nov 06, 2019
Red Hat
100
security advisoryimportantSUSE Linux EnterpriseSUSE: 2019:14014-1 Important: Libtcnative Client Certificates Issues
An update that fixes three vulnerabilities is now available. . SUSE Security Update: Security update for libtcnative-1-0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2019:14014-1 Rating: important References: #1078679 #1103347 #1103348 Cross-References: CVE-2017-15698 CVE-2018-8019 CVE-2018-8020 Affected Products: SUSE Linux Enterprise Server 11-SP4-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libtcnative-1-0 to version 1.1.34 fixes the following issues: - CVE-2017-15698: Fixed an improper handling of fields with more than 127 bytes which could allow invalid client certificates to be accepted (bsc#1078679). - CVE-2018-8019: When using an OCSP responder did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS (bsc#1103348). - CVE-2018-8020: Did not properly check OCSP pre-produced responses. Revoked client certificates may have not been properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS (bsc#1103347). For a complete list of changes please see https://tomcat.apache.org/native-1.1-doc/miscellaneous/changelog.html Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-LTSS: zypper in -t patch slessp4-libtcnative-1-0-14014=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-libtcnative-1-0-14014=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-libtcnative-1-0-14014=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-libtcnative-1-0-14014=1 Package List: - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64): libtcnative-1-0-1.3.4-12.5.5.2 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): libtcnative-1-0-1.3.4-12.5.5.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64): libtcnative-1-0-debuginfo-1.3.4-12.5.5.2 libtcnative-1-0-debugsource-1.3.4-12.5.5.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): libtcnative-1-0-debuginfo-1.3.4-12.5.5.2 libtcnative-1-0-debugsource-1.3.4-12.5.5.2 References: https://www.suse.com/security/cve/CVE-2017-15698.html https://www.suse.com/security/cve/CVE-2018-8019.html https://www.suse.com/security/cve/CVE-2018-8020.html https://bugzilla.suse.com/1078679 https://bugzilla.suse.com/1103347 https://bugzilla.suse.com/1103348 _______________________________________________ sle-security-updates mailing list
Apr 09, 2019
•Important
SuSE
89
security advisoryFedorasecurity fixFedora 27: Security Advisory for Tomcat-Native OCSP Check Bypass
Security fix for CVE-2017-15698. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-7b1517bc6e 2018-02-09 16:29:18.620470 --------------------------------------------------------------------------------Name : tomcat-native Product : Fedora 27 Version : 1.2.16 Release : 1.fc27 URL : https://tomcat.apache.org/tomcat-8.0-doc/apr.html Summary : Tomcat native library Description : Tomcat can use the Apache Portable Runtime to provide superior scalability, performance, and better integration with native server technologies. The Apache Portable Runtime is a highly portable library that is at the heart of Apache HTTP Server 2.x. APR has many uses, including access to advanced IO functionality (such as sendfile, epoll and OpenSSL), OS level functionality (random number generation, system status, etc), and native process handling (shared memory, NT pipes and Unix sockets). This package contains the Tomcat native library which provides support for using APR in Tomcat. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2017-15698 --------------------------------------------------------------------------------References: [ 1 ] Bug #1540824 - CVE-2017-15698 tomcat-native: Mishandling of client certificates can allow for OCSP check bypass https://bugzilla.redhat.com/show_bug.cgi?id=1540824 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade tomcat-native' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Feb 09, 2018
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!