Skip to content
OpenAdvisories
Critical SSA-417159 7 CVEs

SSA-417159: Multiple Vulnerabilities in SINEMA Remote Connect Client Before V3.2 SP2

Published Sep 10, 2024 · Updated Sep 10, 2024

Vendor: Siemens Product: SINEMA Remote Connect Client

Summary

SINEMA Remote Connect Client before V3.2 SP2 is affected by multiple vulnerabilities.

Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version.

Vulnerabilities 7

  • High 8.6
    CVE-2024-2398 EPSS 36%

    HTTP/2 push headers memory-leak

    When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the prev…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2024-2466

    TLS certificate check bypass with mbedTLS

    libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore…

    curl curl curl curl Debian Azure Linux Alpine Wolfi
  • Medium 6.3
    CVE-2024-2379

    QUIC certificate check bypass with wolfSSL

    libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certifica…

    curl curl curl curl Debian Azure Linux Alpine Wolfi
  • Medium 4.4
    CVE-2024-42344

    A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application…

    Siemens SINEMA Remote Connect Client ICS / OT
  • Medium 4.3
    CVE-2024-32006

    A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application…

    Siemens SINEMA Remote Connect Client ICS / OT
  • Low 3.5
    CVE-2024-2004

    Usage of disabled protocol

    When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se wi…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Unscored —
    CVE-2023-46850

    Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execu…

    OpenVPN Access Server OpenVPN 2 (Community) openvpn Debian Alpine

Revision history

  1. #1

    Publication Date

References