Skip to content
OpenAdvisories
Critical SSA-953464 4 CVEs

SSA-953464: Multiple Vulnerabilites in Siemens Brownfield Connectivity - Client before V2.15

Published Feb 14, 2023 · Updated Feb 14, 2023

Vendor: Siemens Product: Brownfield Connectivity - Client

Summary

Siemens has released a new version for Brownfield Connectivity - Client that contains fixes for multiple vulnerabilities in the underlying OpenSSL library. Successful exploitation of these vulnerabilities could lead to Denial of Service (DoS).

Siemens has released an update for Brownfield Connectivity - Client and recommends to update to the latest version.

Vulnerabilities 4

  • Critical 9.8
    CVE-2022-1292 Public exploit EPSS 83%

    The c_rehash script allows command injection

    The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2022-1473

    Resource leakage when decoding certificates and keys

    The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes cer…

    OpenSSL OpenSSL openssl openssl Ubuntu Alpine crates.io
  • Medium 5.9
    CVE-2022-1434

    Incorrect MAC key used in the RC4-MD5 ciphersuite

    The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from …

    OpenSSL OpenSSL openssl openssl Ubuntu Alpine crates.io
  • Medium 5.3
    CVE-2022-1343

    OCSP_basic_verify may incorrectly verify the response signing certificate

    The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response sig…

    OpenSSL OpenSSL openssl openssl Ubuntu Alpine crates.io

Revision history

  1. #1

    Publication Date

References