KENNETH – 지락문화예술공작단

[OPENSSL] problem sni after update google chrome browser

2023-10-03 KENNETH 0

problem sni after update google chrome browser 증상 단일 서버(openssl+apache) 구동중 다수의 도메인이 설정되어 있으며, 각 도메인에는 SSL인증서가 적용되어 있음 여러 도메인이 443포트를 같이 사용중 (by SNI) 크롬 업데이트 후 설정상 가장 첫도메인을 제외한 나머지 도메인의 “https://”연결이 되지 않음 크롬 오류 메세지 : ERR_SSL_PROTOCOL_ERROR 브라우저 Google Chrome Version : 117.0.5938.132 Date : 2023.09.27(??) 이전 버전의 크롬에서는 문제가 발생하지 않음 그 외 엣지, 파이폭스 등의 브라우저에서는 문제가 발생하지 않음 서버 OS : RHEL6 openssl : openssl-1.0.1e-30.el6.8.x86_64 참고 RHEL6 : https://bugzilla.redhat.com/show_bug.cgi?id=1150032 RHEL7 : https://bugzilla.redhat.com/show_bug.cgi?id=1150033 업데이트 해결버전 : openssl-1.0.1e-34.el6 RHEL6 의 경우 이미 지원이 종료되었으나 종료전 마지막 버전 openssl-1.0.1e-58.el6_10.x86_64 으로 패치 패치 전 패치 후

USN-6307-1: JOSE for C/C++ vulnerability

2023-08-25 KENNETH 0

USN-6307-1: JOSE for C/C++ vulnerability It was discovered that JOSE for C/C++ AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. An attacker could use this to cause a denial of service (system crash) or might expose sensitive information. Source: USN-6307-1: JOSE for C/C++ vulnerability

USN-6306-1: Fast DDS vulnerabilities

2023-08-25 KENNETH 0

USN-6306-1: Fast DDS vulnerabilities It was discovered that Fast DDS incorrectly handled certain inputs. A remote attacker could possibly use this issue to cause a denial of service and information exposure. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-38425) It was discovered that Fast DDS incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash. (CVE-2023-39534, CVE-2023-39945, CVE-2023-39946, CVE-2023-39947, CVE-2023-39948, CVE-2023-39949) Source: USN-6306-1: Fast DDS vulnerabilities

Announcing Windows 11 Insider Preview Build 22621.2262 and 22631.2262 (Beta Channel)

2023-08-25 KENNETH 0

Announcing Windows 11 Insider Preview Build 22621.2262 and 22631.2262 (Beta Channel) {$inline_image} Hello Windows Insiders, today we are releasing Windows 11 Insider Preview Build 22621.2262 and Build 22631.2262 (KB5029339) to the Beta Channel. IMPORTANT: Due to the bug in the previous Beta Channel flight, the “Check for updates” button does not appear as expected under Settings > Windows Update. As a workaround to get this update immediately, you can open Windows Terminal (or the Run dialog) and enter the USOClient StartInteractiveScan command which will perform the same function as clicking the “Check for updates” button in Windows Update. Note that running the command will not display any output. To confirm that the operation was successful, you can run the command while the Windows Update settings page is open. You should see your device checking for updates. Once you’re on this [ more… ]

USN-6305-1: PHP vulnerabilities

2023-08-24 KENNETH 0

USN-6305-1: PHP vulnerabilities It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. (CVE-2023-3823) It was discovered that PHP incorrectly handled certain PHAR files. An attacker could possibly use this issue to cause a crash, expose sensitive information or execute arbitrary code. (CVE-2023-3824) Source: USN-6305-1: PHP vulnerabilities