High ICSA-22-258-05 14 CVEs

Siemens SINEC INS

Published Sep 13, 2022 · Updated Sep 13, 2022

Vendor: Siemens Product: SINEC INS

Summary

Multiple vulnerabilities affecting various third-party components of
SINEC INS before V1.0 SP2 could allow an attacker to cause a denial of
service condition, disclose sensitive data or violate the system
integrity. Siemens has released an update for the SINEC INS and
recommends to update to the latest version.

Vulnerabilities 14

High 8.8

CVE-2022-0235

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

node-fetch node-fetch/node-fetch node-fetch node-fetch Debian Ubuntu npm

Jan 16, 2022
High 8.0

CVE-2022-0155 Public exploit

Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

follow-redirects follow-redirects/follow-redirects js-jquery follow-redirects Debian Ubuntu Azure Linux npm

Jan 10, 2022
High 7.8

CVE-2020-12762

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_…

json-c json-c json-c libfastjson Debian Ubuntu Azure Linux Alpine

May 9, 2020
High 7.5

CVE-2020-7793

Regular Expression Denial of Service (ReDoS)

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).

ua-parser-js node-ua-parser-js node-ua-parser-js Debian Ubuntu npm

Dec 11, 2020
High 7.5

CVE-2021-3749 Public exploit

Inefficient Regular Expression Complexity in axios/axios

axios is vulnerable to Inefficient Regular Expression Complexity

axios axios/axios node-axios node-axios Debian Ubuntu npm

Aug 31, 2021
High 7.4

CVE-2021-25217

A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient

In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is …

ISC ISC DHCP isc-dhcp isc-dhcp Debian Ubuntu Azure Linux Alpine

May 26, 2021
High 7.2

CVE-2021-23337 Public exploit Scanner template EPSS 20%

Command Injection

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

js-jquery lodash node-lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems

Feb 15, 2021
Medium 6.8

CVE-2021-25220

DNS forwarders - cache poisoning vulnerability

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to…

ISC BIND bind9 bind9 Debian Ubuntu Azure Linux Alpine

Mar 23, 2022
Medium 5.9

CVE-2020-28168

Axios vulnerable to Server-Side Request Forgery

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

node-axios axios node-axios Debian Ubuntu npm

Nov 6, 2020
Medium 5.9

CVE-2021-23841 Public exploit

Null pointer deref in X509_issuer_and_serial_hash()

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …

OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io

Feb 16, 2021
Medium 5.3

CVE-2020-28500

Regular Expression Denial of Service (ReDoS)

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

js-jquery node-lodash lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems

Feb 15, 2021
Medium 5.3

CVE-2022-0396

DoS from specifically crafted TCP packets

BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after t…

ISC BIND bind9 bind9 Debian Ubuntu Azure Linux Alpine

Mar 23, 2022
Unscored —

CVE-2021-23839

Incorrect SSLv2 rollback protection

OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that …

OpenSSL OpenSSL openssl openssl Debian Alpine

Feb 16, 2021
Unscored —

CVE-2021-4160

BN_mod_exp may produce incorrect results on MIPS

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and i…

OpenSSL OpenSSL openssl edk2 Debian Ubuntu Azure Linux

Jan 28, 2022

Revision history

2022-09-13 #1
Publication Date

References

SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-637483.txt
SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
ICS Advisory ICSA-22-258-05 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-258-05
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B