The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Prior to UR firmware Version 8.1x, UR supported various encryption and MAC algorithms for SSH communication, some of which are weak. The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. Prior to UR firmware Version 8.1x, UR supported various encryption and MAC algorithms for SSH communication, some of which are weak. The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext. Prior to firmware Version 7.4x, UR supported only SSHv2. Starting from firmware Version 7.4x, UR added support to SSHv1. SSHv1 has known vulnerabilities (SSH protocol session key retrieval and insertion attack). SSH 1.2.25, 1.2.23, and other versions, when used in in CBC (Cipher Block Chaining) or CFB (Cipher Feedback 64 bits) modes, allows remote attackers to insert arbitrary data into an existing stream between an SSH client and server by using a known plaintext attack and computing a valid CRC-32 checksum for the packet, aka the "SSH insertion attack." GE U…

SkyBridge MB-A100/A110/A200/A130 SkySpider MB-R210 provided by Seiko Solutions Inc. contain multiple vulnerabilities listed below. <ul> <li>Exposure of sensitive information to an unauthorized actor (CWE-200) - CVE-2016-2183 <li>Command injection (CWE-77) - CVE-2022-36556 <li>Unrestricted upload of file with dangerous type (CWE-434) - CVE-2022-36557 <li>Use of hard-coded credentials (CWE-798) - CVE-2022-36558 <li>Command injection (CWE-77) - CVE-2022-36559 <li>Use of hard-coded credentials (CWE-798) - CVE-2022-36560 <li>Improper privilege management (CWE-269) - CVE-2023-22361 <li>Missing authentication for critical function (CWE-306) - CVE-2023-22441 <li>Improper access control (CWE-284) - CVE-2023-23578 <li>Improper following of a certificate's chain of trust (CWE-296) - CVE-2023-23901 <li>Missing authentication for critical function (CWE-306) - CVE-2023-23906 <li>Cleartext storage of sensitive information (CWE-312) - CVE-2023-24586 <li>Cleartext transmission of sensitive information (CWE-319) - CVE-2023-25070 <li>Use of weak credentials (CWE-1391) - CVE-2023-25072 <li>Use of weak credentials (CWE-1391) - CVE-2023-25184 </ul> The developer states that attacks exploiting CVE-2022-36556 have been observed. CVE-2023-22441 MASAHIRO IIDA of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2016-2183, CVE-2022-36556, CVE-2022-36557, CVE-2022-36558, CVE-20…

nodejs4-4.7.0-1.1 on GA media

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

Security update for openssl

Affected: Ubuntu:14.04:LTS: nss, Ubuntu:14.04:LTS: openjdk-6, Ubuntu:14.04:LTS: openjdk-7, Ubuntu:14.04:LTS: openssl, Ubuntu:16.04:LTS: nss, Ubuntu:16.04:LTS: openjdk-8, Ubuntu:16.04:LTS: openssl

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Multiple Weidmueller products are affected by an OpenSSL vulnerability.

Weidmüller has released new firmwares of the affected products to fix the vulnerability.

The TRUMPF remote support infrastructure selects an outdated encryption algorithm when setting up communication channels for machines. This cannot be prevented for old machines. For most machines it is possible to change the encryption settings.

Vulnerabilities in PROFINET-Switch devices with firmware <= V1.12.010 that allow an attacker to gain control over the device.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.