Sophos Unified Threat Management (UTM) Software: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• High 7.5
  CVE-2023-0215

  Use-after-free following BIO_new_NDEF

  The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io
  Feb 8, 2023
• High 7.4
  CVE-2023-0286 Public exploit EPSS 68%

  X.400 address type confusion in X.509 GeneralName

  There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI crates.io
  Feb 8, 2023
• Unscored —
  CVE-2002-20001 Public exploit EPSS 25%

  The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that…

  Nov 11, 2021
• Unscored —
  CVE-2022-40735

  The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecess…

  nodejs openssl Ubuntu
  Nov 14, 2022

Revision history

1. 2024-06-26 #2

   Neue Updates von Ubuntu aufgenommen

2. 2023-07-25 #1

   Initiale Fassung

References

• Sophos Security Advisory vom 2023-07-25
  https://community.sophos.com/utm-firewall/b/blog/posts/utm-up2date-9-716-released
• Ubuntu Security Notice USN-6854-1 vom 2024-06-27
  https://ubuntu.com/security/notices/USN-6854-1