Skip to content
OpenAdvisories
High SSA-744259 8 CVEs

SSA-744259: Golang Vulnerabilities in Brownfield Connectivity - Gateway before V1.10.1

Published Feb 14, 2023 · Updated Feb 14, 2023

Vendor: Siemens Product: Brownfield Connectivity - Gateway

Summary

Siemens has released a new version for Brownfield Connectivity - Gateway that contains fixes for multiple vulnerabilities in the underlying Golang implementation. Successful exploitation of these vulnerabilities could lead to Denial of Service (DoS).

Siemens has released an update for Brownfield Connectivity - Gateway and recommends to update to the latest version.

Vulnerabilities 8

  • High 7.5
    CVE-2021-44716

    golang.org/x/net/http2 allows uncontrolled memory consumption

    net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-41771

    Panic on invalid symbol tables in debug/macho

    ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-41772

    Panic when opening certain archives in archive/zip

    Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

    golang go stdlib golang-1.8 Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-44717

    Misdirected I/O in syscall

    Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

    go stdlib golang-1.8 golang-1.17 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2022-24675 Public exploit

    Stack overflow from a large amount of PEM data in encoding/pem

    encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

    golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-24921

    Stack exhaustion when compiling deeply nested expressions in regexp

    regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-27536

    Panic during certificate parsing on Darwin in crypto/x509

    Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.

    golang go stdlib Azure Linux Alpine Go
  • Unscored —
    CVE-2022-28327

    Panic due to large inputs affecting P-256 curves in crypto/elliptic

    The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

    golang go stdlib golang-1.18 Ubuntu Azure Linux Alpine Go

Revision history

  1. #1

    Publication Date

References