High WID-SEC-2024-1696 6 CVEs

SolarWinds Platform: Mehrere Schwachstellen

Published Jul 23, 2024 · Updated Oct 15, 2024 · Revision 2 · de-DE

Vendor: SolarWinds Product: Platform Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SolarWinds Platform ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Daten zu manipulieren und vertrauliche Informationen preiszugeben.

Product

SolarWinds Platform (ehemals "Orion") ist eine IT Performance-Monitoring Plattform.

Vulnerabilities 6

Critical 9.8

CVE-2022-37601

Prototype pollution in webpack loader-utils

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

reaper jitsucom-jitsu loader-utils node-loader-utils Debian Ubuntu Azure Linux Wolfi npm

Oct 12, 2022
High 7.5

CVE-2023-38325

cryptography mishandles SSH certificates

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

cryptography py3-cryptography conda Alpine Wolfi PyPI

Jul 14, 2023
High 7.0

CVE-2023-29483

Potential DoS via the Tudoor mechanism in eventlet and dnspython

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does n…

kubeflow-pipelines-visualization-server dnspython eventlet dnspython Debian Ubuntu Wolfi PyPI

Apr 11, 2024
Medium 5.9

CVE-2023-49083

cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerab…

pyca cryptography py3-cassandra-medusa mitmproxy Debian Ubuntu Azure Linux Wolfi PyPI

Nov 29, 2023
Medium 5.9

CVE-2023-52323

PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

jwt-tool pycryptodome pycryptodome pycryptodome Debian Ubuntu Wolfi PyPI

Jan 5, 2024
Medium 5.5

CVE-2024-0727

PKCS12 Decoding crashes

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in …

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Jan 26, 2024

Revision history

2024-10-15 #2
Neue Updates aufgenommen
2024-07-23 #1
Initiale Fassung

References

SolarWinds Platform 2024.2.1 release notes vom 2024-07-23
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2-1_release_notes.htm
SolarWinds Platform 2024.4 release notes vom 2024-10-16
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-4_release_notes.htm