Critical SSA-099606 8 CVEs

SSA-099606: Multiple Vulnerabilities in SIMATIC MV500 before V3.3.5

Published Nov 14, 2023 · Updated Nov 14, 2023

Vendor: Siemens Product: SIMATIC MV500 family

Summary

SIMATIC MV500 before V3.3.5 is affected by multiple vulnerabilities.

Siemens has released an update for SIMATIC MV500 and recommends to update to the latest version.

Vulnerabilities 8

Critical 9.8

CVE-2022-23218

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34…

glibc eglibc glibc glibc Debian Ubuntu Azure Linux

Jan 14, 2022
Critical 9.8

CVE-2022-23219

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 co…

glibc eglibc glibc glibc Debian Ubuntu Azure Linux

Jan 14, 2022
High 7.8

CVE-2023-35788 Public exploit

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an o…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Jun 16, 2023
Medium 6.5

CVE-2022-44792 EPSS 52%

handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bu…

net-snmp net-snmp net-snmp net-snmp Debian Ubuntu Azure Linux Alpine

Nov 7, 2022
Medium 6.5

CVE-2022-44793 EPSS 53%

handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Except…

net-snmp net-snmp net-snmp net-snmp Debian Ubuntu Azure Linux Alpine

Nov 7, 2022
Medium 5.3

CVE-2023-2975

AES-SIV implementation ignores empty associated data entries

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data …

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 14, 2023
Medium 5.3

CVE-2023-3446

Excessive time spent checking DH keys and parameters

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 19, 2023
Medium 5.3

CVE-2023-3817

Excessive time spent checking DH q parameter value

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 31, 2023

Revision history

2023-11-14 #1
Publication Date

References

SSA-099606: Multiple Vulnerabilities in SIMATIC MV500 before V3.3.5 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-099606.html
SSA-099606: Multiple Vulnerabilities in SIMATIC MV500 before V3.3.5 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-099606.pdf
SSA-099606: Multiple Vulnerabilities in SIMATIC MV500 before V3.3.5 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-099606.txt