Skip to content
OpenAdvisories
High NCSC-2024-0239 14 CVEs

Kwetsbaarheden verholpen in Solarwinds Platform

Published Jun 7, 2024 · Updated Jun 7, 2024 · nl

Vendor: SolarWinds Product: Orion Platform Product: SolarWinds Platform

Summary

Solarwinds heeft kwetsbaarheden verholpen in Solarwinds Platform.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, een command-injection uit te voeren, of om een Cross-Site-Scripting-aanval uit te voeren. Een dergelijke aanval kan leiden tot uitvoer van willekeurige code in de browser van het slachtoffer.

Voor succesvol misbruik moet de kwaadwillende voorafgaande authenticatie hebben.

Oplossingen
Solarwinds heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Solarwinds Platform 2024.2

In deze updates zijn tevens kwetsbaarheden verholpen in onderliggende third-party software waar het platform gebruik van maakt. Voor deze kwetsbaarheden zijn eerdere beveiligingsadviezen gepubliceerd.

Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 14

  • High 7.5
    CVE-2021-23840 Public exploit EPSS 51%

    Integer overflow in CipherUpdate

    Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  • High 7.5
    CVE-2022-0778 Public exploit EPSS 73%

    Infinite loop in BN_mod_sqrt() reachable when parsing certificates

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine crates.io
  • High 7.5
    CVE-2023-0215

    Use-after-free following BIO_new_NDEF

    The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io
  • High 7.5
    CVE-2024-28996

    SolarWinds Platform SWQL Injection Vulnerability

    The SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability.  

    SolarWinds SolarWinds Platform
  • High 7.4
    CVE-2021-3712 Public exploit EPSS 48%

    Read buffer overruns processing ASN.1 strings

    ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  • High 7.4
    CVE-2023-0286 Public exploit EPSS 68%

    X.400 address type confusion in X.509 GeneralName

    There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI crates.io
  • High 7.1
    CVE-2024-29004

    SolarWinds Platform Stored XSS Vulnerability

    The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability.

    SolarWinds SolarWinds Platform
  • Medium 6.4
    CVE-2024-28999 Public exploit EPSS 14%

    SolarWinds Platform Race Condition Vulnerability

    The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.

    SolarWinds SolarWinds Platform
  • Medium 5.9
    CVE-2020-1971 Public exploit

    EDIPARTYNAME NULL pointer dereference

    The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-3736 EPSS 10%

    There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before …

    OpenSSL Software Foundation OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2018-0732 EPSS 47%

    Client DoS due to large DH parameter

    During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-0737 EPSS 12%

    Cache timing vulnerability in RSA Key Generation

    The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in Open…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-1559 EPSS 17%

    0-byte record padding oracle

    If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-4321

    Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security poli…

    Google Chrome chromium Browsers Debian

Revision history

  1. #0

    Initiele versie

References