Marcus Brinkmann

Nome do Software Vulnerável e Versões Afetadas: Versões do Apache HTTP Server até a 2.4.63 Descrição: Em certas configurações do mod ssl, um atacante man-in-the-middle pode sequestrar uma sessão HTTP por meio de um ataque de upgrade TLS. Este problema afeta configurações que utilizam "SSLEngine optional" para habilitar upgrades TLS. O ataque está relacionado à dessincronização HTTP. Recomendações: Atualize para a versão 2.4.64, que remove o suporte para upgrade TLS.

O problema surge de certas mensagens de e-mail MIME manipuladas que afirmam conter uma mensagem OpenPGP criptografada, mas na verdade contêm uma mensagem assinada com OpenPGP, as quais são exibidas incorretamente como estando criptografadas.

The issue is related to the implementation of the S/MIME standard in the Thunderbird email client, specifically with errors in checking the cryptographic signature due to a mismatch in the date and time of its creation. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information by giving recipients the impression that a message was sent at a different date or time.

The issue is related to errors in handling OpenPGP cryptographic signatures. Exploitation of this issue may allow a remote attacker to perform a spoofing attack. When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was not shown to the user because it was interpreted as a MIME message and treated as an email header section. This could be used to spoof an email message, potentially using a digitally signed text from a different context.

The issue is related to OS command injection in OpenSSH, which might occur if a user name or host name has shell metacharacters and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name. The estimated number of potentially affected devices worldwide is around 116,742,290, mainly distributed in the United States, China, and other countries.

The issue is related to errors in key management in the ssh-agent tool of OpenSSH. It allows an attacker to disclose protected information by exploiting certain destination constraints that are not fully applied when adding PKCS#11-hosted private keys. Specifically, when destination constraints are specified, they are only applied to the first key, even if a PKCS#11 token returns multiple keys. This can be exploited by sending a specially crafted request to obtain sensitive information, which can then be used to launch further attacks against the affected system.

The SSH transport protocol with certain OpenSSH extensions is vulnerable to a prefix truncation attack, known as the Terrapin attack. This attack allows a man-in-the-middle attacker to strip an arbitrary number of messages right after the initial key exchange, breaking SSH extension negotiation and downgrading connection security. The attack works by injecting arbitrary SSH MSG IGNORE messages during the initial key exchange and removing the same number of messages just after the initial key exchange has concluded. This is possible due to missing authentication of the excess SSH MSG IGNORE messages and the fact that the implicit sequence numbers used within the SSH protocol are only checked after the initial key exchange.

O problema está relacionado à verificação insuficiente dos dados de autenticação na implementação do protocolo SSH no PuTTY. Isso pode permitir que um invasor remoto obtenha acesso não autorizado a informações protegidas. Especificamente, o PuTTY prossegue com o estabelecimento de uma sessão SSH mesmo que nunca tenha recebido uma resposta de autenticação válida, facilitando que um servidor SSH controlado pelo invasor apresente posteriormente um prompt de autenticação falsificado. Isso pode ser usado para capturar dados de credenciais para fins indesejados pelo usuário cliente.

O problema está relacionado a erros no gerenciamento de privilégios dentro do componente Plataforma HTML do Windows do sistema operacional Windows. Isso pode permitir que um invasor remoto contorne as restrições de segurança existentes.

The issue is related to the Secure/Multipurpose Internet Mail Extensions (S/MIME) functionality in the Thunderbird email client, specifically concerning the lack of protection for certain data. This could allow a remote attacker to gain unauthorized access to protected information. Additionally, it is noted that encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in an HTML reply or forward.

The issue lies in the signature verification routine of the install.sh script, which only checks if a yarn release is signed by any key in the user's local keyring. This does not ensure the release is signed by the official yarn release key, allowing remote attackers to sign tampered packages with their own key.

The issue concerns the signature verification routine, which fails to verify the status of the signature and the validity of the signing key. This allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature or by creating a key with a fake user ID (email address) and injecting it into the user's keyring.

An issue in the password-store.sh script of Simple Password Store allows remote attackers to spoof file signatures on configuration files and extension scripts due to an incomplete regular expression in the signature verification routine. This can lead to the disclosure of passwords if an attacker modifies the configuration file to inject additional encryption keys. Furthermore, modifying the extension scripts can allow the attacker to execute arbitrary code.

The issue concerns the signature verification routine, which incorrectly interprets user ids as status/control messages and fails to track the status of multiple signatures. This allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

The issue is related to the mishandling of the original filename during decryption and verification actions in the mainproc.c component. This allows remote attackers to spoof output sent to other programs using the "--status-fd 2" option, potentially affecting the integrity of protected information. For instance, an OpenPGP data representation of an original filename with line feed characters, in conjunction with GOODSIG or VALIDSIG status codes, can be exploited.