Skip to content
OpenAdvisories
High SSA-108696 5 CVEs

SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400

Published Feb 13, 2024 · Updated Feb 13, 2024

Vendor: Siemens Product: SIDIS Prime

Summary

SIDIS Prime before V4.0.400 is affected by multiple vulnerabilities in the components OPC UA and OpenSSL, that could allow an unauthenticated attacker with access to the network where SIDIS Prime is installed to reuse OPC UA client credentials, create a denial of service condition of the SIDIS Prime OPC UA client, or create a denial of service condition of the SIDIS Prime TLS service.

Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.

Vulnerabilities 5

  • High 7.5
    CVE-2020-1967 Public exploit EPSS 53%

    Segmentation fault in SSL_check_chain

    Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an i…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine crates.io
  • High 7.5
    CVE-2022-0778 Public exploit EPSS 73%

    Infinite loop in BN_mod_sqrt() reachable when parsing certificates

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine crates.io
  • High 7.5
    CVE-2022-29862

    Security Update for the OPC UA .NET Standard Stack

    An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.

    OPCFoundation.NetStandard.Opc.Ua.Core NuGet
  • High 7.4
    CVE-2019-19135

    Insufficient Nonce Validation in Eclipse Milo Client

    In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the net…

    org.eclipse.milo:sdk-client Maven
  • Medium 5.9
    CVE-2020-1971 Public exploit

    EDIPARTYNAME NULL pointer dereference

    The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

Revision history

  1. #1

    Publication Date

References