top of page
tacalremathi

[Howto] Correct ldap “protocol error” in Gitea and other Go based projects



0-byte record padding oracle (CVE-2019-1559) (Moderate) If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data.




[Howto] Fix ldap “protocol error” in Gitea (and other Go based apps)




All versions of Node.js 6 and later are vulnerable and the severity is LOW. If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect. 2ff7e9595c


0 views0 comments

Recent Posts

See All

Коментарі


bottom of page