Fallos del tipo CWE-757

31 resultados

Degradação de Algoritmo de Segurança em Negociação

É quando um protocolo ou aplicação permite que cliente e servidor acordem usar um algoritmo criptográfico mais fraco do que o disponível, tipicamente para manter compatibilidade com versões antigas. O atacante força ou explora essa negociação para rebaixar a segurança e quebrar a criptografia mais facilmente.

Ejemplo

Um cliente TLS oferece tanto TLS 1.3 (seguro) quanto SSL 3.0 (quebrado há anos). Um atacante na rede intercepta a negociação, descarta as opções modernas e força o servidor a aceitar SSL 3.0, permitindo descriptografar o tráfego via ataques conhecidos como POODLE.

Cómo mitigar

Configure cliente e servidor para recusar algoritmos deprecados e versões de protocolo antigas — nunca deixe fallback automático para cifras fracas. Nos clientes, sempre priorize e valide apenas algoritmos modernos; nos servidores, bloqueie conexões que insistirem em protocolos obsoletos.

CVE-2020-10135MEDIUMBluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacksEPSS 2.4%CVE-2017-9269HIGHlack of keypinning in libzypp could lead to repository switchingEPSS 2.3%CVE-2021-36326MEDIUMDell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface (UI). A remote unauthenticaEPSS 1.2%CVE-2025-24154CRITICALAn out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, maEPSS 1.2%CVE-2019-14887HIGHA flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't hoEPSS 1.1%CVE-2017-9267MEDIUMeDirectory LDAP peer certificate validation issueEPSS 1.0%CVE-2024-4995CRITICALProtocol Downgrade in Wapro ERP DesktopEPSS 0.9%CVE-2023-2974MEDIUMQuarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported tls protocolEPSS 0.9%CVE-2019-16791MEDIUMdowngrade of effective Strict Transport Security (STS) policy in postfix-mta-sts-resolverEPSS 0.8%CVE-2020-16200MEDIUMPhilips Clinical Collaboration Platform Algorithm DowngradeEPSS 0.6%CVE-2018-25029—The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radioEPSS 0.6%CVE-2024-20069MEDIUMIn modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. This could lead EPSS 0.6%CVE-2024-23656HIGHDex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphersEPSS 0.4%CVE-2026-2673MEDIUMOpenSSL TLS 1.3 server may choose unexpected key agreement groupEPSS 0.4%CVE-2024-8773HIGHProtocol Downgrade in SIMPLE.ERPEPSS 0.4%CVE-2024-38883CRITICALAn issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker tEPSS 0.4%CVE-2025-10693HIGHSilicon Labs Z-Wave PIR Sensor Joins Network as Non-SecureEPSS 0.3%CVE-2022-33160LOWIBM Security Directory Suite information disclosureEPSS 0.3%CVE-2026-4942MEDIUMIBM i is Affected by Algorithm Downgrade in Transport Layer Security []EPSS 0.3%CVE-2026-55953CRITICALTLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authenticationEPSS 0.2%