Fallos del tipo CWE-757

42 resultados

Degradação de Algoritmo de Segurança em Negociação

É quando um protocolo ou aplicação permite que cliente e servidor acordem usar um algoritmo criptográfico mais fraco do que o disponível, tipicamente para manter compatibilidade com versões antigas. O atacante força ou explora essa negociação para rebaixar a segurança e quebrar a criptografia mais facilmente.

Ejemplo

Um cliente TLS oferece tanto TLS 1.3 (seguro) quanto SSL 3.0 (quebrado há anos). Um atacante na rede intercepta a negociação, descarta as opções modernas e força o servidor a aceitar SSL 3.0, permitindo descriptografar o tráfego via ataques conhecidos como POODLE.

Cómo mitigar

Configure cliente e servidor para recusar algoritmos deprecados e versões de protocolo antigas — nunca deixe fallback automático para cifras fracas. Nos clientes, sempre priorize e valide apenas algoritmos modernos; nos servidores, bloqueie conexões que insistirem em protocolos obsoletos.

CVE-2026-107279HIGHAsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-intEPSS 0.4%CVE-2026-89177HIGHHowyar｜WeenyGenius - Use of Insecure ProtocolEPSS 0.4%CVE-2026-18691CRITICALImproper Authentication in MongoDB Intra-Cluster Connections Allows Credential ExposureEPSS 0.4%CVE-2024-38883CRITICALAn issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker tEPSS 0.4%CVE-2026-109952MEDIUMFreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation ResponseEPSS 0.3%CVE-2022-33160LOWIBM Security Directory Suite information disclosureEPSS 0.3%CVE-2025-10693HIGHSilicon Labs Z-Wave PIR Sensor Joins Network as Non-SecureEPSS 0.3%CVE-2026-53712HIGHSCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithmsEPSS 0.3%CVE-2025-36582MEDIUMDell NetWorker, versions 19.12.0.1 and prior, contains a Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') vulneEPSS 0.3%CVE-2026-48747MEDIUMSymfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm DowngradeEPSS 0.2%CVE-2026-1677MEDIUMnet: TLS 1.2 connections allowed on TLS 1.3 socketsEPSS 0.2%CVE-2026-59293MEDIUMSMB minimum protocol dialect defaults to SMB1EPSS 0.2%CVE-2026-107231HIGHAsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextEPSS 0.2%CVE-2026-54780LOWCoreWCF: WS-Security Reference DigestMethod Algorithm-Suite BypassEPSS 0.2%CVE-2026-54291HIGHSilent channel-binding authentication downgrade via unsupported certificate algorithmsEPSS 0.2%CVE-2025-59270LOWpsPAS does not enforce TLS 1.2 within Get-PASSAMLResponseEPSS 0.2%CVE-2026-55953CRITICALTLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authenticationEPSS 0.2%CVE-2026-32650HIGHAnviz CrossChex Standard Algorithm DowngradeEPSS 0.2%CVE-2026-20578MEDIUMIn Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to remote denial of serviceEPSS 0.2%CVE-2022-23000HIGHWeak Default SSL use in Port Forwarding ServiceEPSS 0.2%