Nurullah Erinola

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions through 2.4.63 Description: In certain mod ssl configurations, a man-in-the-middle attacker can hijack an HTTP session through a TLS upgrade attack. This issue affects configurations utilizing “SSLEngine optional” to enable TLS upgrades. The attack is related to HTTP desynchronization. Recommendations: Upgrade to version 2.4.64, which removes support for TLS upgrade.

**Name of the Vulnerable Software and Affected Versions** Oracle Java SE versions 11.0.17, 17.0.5, 19.0.1 Oracle GraalVM Enterprise Edition versions 20.3.8, 21.3.4, 22.3.0 **Description** The issue is related to an easily exploitable vulnerability in the JSSE component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access via DTLS to compromise the system, resulting in a partial denial of service. The vulnerability applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security. **Recommendations** For Oracle Java SE versions 11.0.17, 17.0.5, 19.0.1, update to a newer version that contains a fix for this issue. For Oracle GraalVM Enterprise Edition versions 20.3.8, 21.3.4, 22.3.0, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the DTLS protocol to minimize the risk of exploitation. Note: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eclipse Californium versions 2.0.0 through 2.7.2 Eclipse Californium versions 3.0.0 through 3.5.0 **Description** The issue occurs when a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. This can result in message amplification, potentially leading to DDoS attacks on other peers, and high CPU load, leading to a DoS attack on the own peer. The misbehavior is specific to configurations where DTLS VERIFY PEERS ON RESUMPTION THRESHOLD values are larger than 0, especially when used with certificate-based cipher suites. **Recommendations** For Eclipse Californium versions 2.0.0 through 2.7.2, consider updating to a version where this issue is fixed. For Eclipse Californium versions 3.0.0 through 3.5.0, consider updating to a version where this issue is fixed. As a temporary workaround, consider setting DTLS VERIFY PEERS ON RESUMPTION THRESHOLD to 0 to prevent the misbehavior, but be aware of the potential security implications of this change. At the moment, there is no information about a newer version that contains a fix for this vulnerability.