Critical SSA-892048 9 CVEs

SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1

Published May 9, 2023 · Updated May 9, 2023

Vendor: Siemens Product: SINEC NMS

Summary

Multiple vulnerabilities affecting third-party components libexpat and libcurl of SINEC NMS before V1.0.3.1 could allow an attacker to impact SINEC NMS confidentiality, integrity and availability.

Siemens has released an update for SINEC NMS and recommends to update to the latest version.

Vulnerabilities 9

Critical 9.8

CVE-2022-32221

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data …

curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine Wolfi

Dec 5, 2022
High 8.1

CVE-2022-40674

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Sep 14, 2022
High 8.1

CVE-2022-42915

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it se…

curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine

Oct 29, 2022
High 7.5

CVE-2022-42916

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, cur…

curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine Wolfi

Oct 29, 2022
High 7.5

CVE-2022-43551 EPSS 17%

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS…

curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine Wolfi

Dec 23, 2022
High 7.5

CVE-2022-43680 Public exploit

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…

thunderbird insighttoolkit4 expat swish-e Debian Ubuntu Azure Linux Alpine

Oct 24, 2022
Medium 5.9

CVE-2022-43552

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it support…

mysql curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

Feb 9, 2023
Low 3.7

CVE-2022-35252

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Sep 23, 2022
Unscored —

CVE-2022-35260

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white s…

curl curl tensorflow Debian Azure Linux Alpine

Dec 5, 2022

Revision history

2023-05-09 #1
Publication Date

References

SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-892048.html
SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-892048.pdf
SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-892048.txt