Summary
Multiple vulnerabilities in the included versions of OpenSSL can lead to different problems, including crashes of the OpenSSL modules (leading to a Denial of Service) or leakage of plaintext. These underlying vulnerabilities can be fixed by installing a software update provided by TRUMPF.
Details
Impact
The TRUMPF products enumerated above include a vulnerable version of OpenSSL 1.1.x which can be exploited to crash the application or to attack some encryption modes, revealing plain text. This can impact confidentiality, integrity and availability of information on the affected system.
Mitigation
Please contact your TRUMPF Service with the PR number 500876.
Vulnerabilities 3
-
Critical 9.8
SM2 Decryption Buffer Overflow
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" paramet…
-
High 7.5
Integer overflow in CipherUpdate
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …
-
High 7.5CVE-2022-2097 Public exploit
AES OCB fails to encrypt some bytes
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…
Revision history
-
#1
Initial revision.
References
-
VDE-2024-006: TRUMPF: Oseon contains vulnerable version of OpenSSL 1.1.x - HTML
https://certvde.com/en/advisories/VDE-2024-006/
-
CERT@VDE Security Advisories for WAGO GmbH & Co. KG
https://certvde.com/en/advisories/vendor/wago/
-
Security with TRUMPF
https://www.trumpf.com/en_INT/meta/security-with-trumpf/