ICSA-23-047-04

Siemens Brownfield Connectivity Gateway

view advisory published 2023-02-14

Siemens has released a new version for Brownfield Connectivity - Gateway that contains fixes for multiple vulnerabilities in the underlying Golang implementation. Successful exploitation of these vulnerabilities could lead to Denial of Service (DoS). Siemens has released an update for Brownfield Connectivity - Gateway and recommends to update to the latest version.

describes (8)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-28327US	high7.5	4.16% (91st)	—	2022-04-20
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
CVE-2022-27536US	high7.5	1.47% (74th)	—	2022-04-20
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to…
CVE-2022-24675US	high7.5	9.95% (96th)	Exploit	2022-04-20
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
CVE-2022-24921US	high7.5	3.23% (88th)	—	2022-03-05
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVE-2021-44717US	medium4.8	1.86% (79th)	—	2022-01-01
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file desc…
CVE-2021-44716US	high7.5	3.96% (90th)	—	2022-01-01
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
CVE-2021-41772US	high7.5	3.25% (88th)	—	2021-11-08
Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.
CVE-2021-41771US	high7.5	4.70% (92nd)	—	2021-11-08
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice…

references

External citations — patches, advisories, analysis.

remediations (8)

FixedBrownfield Connectivity - Gateway
Update to V1.11 or later version Contact customer support to obtain the update <https://support.industry.siemens.com/cs/de/de/view/109801700>
FixedBrownfield Connectivity - Gateway
Update to V1.11 or later version Contact customer support to obtain the update <https://support.industry.siemens.com/cs/de/de/view/109801700>
FixedBrownfield Connectivity - Gateway
Update to V1.11 or later version Contact customer support to obtain the update <https://support.industry.siemens.com/cs/de/de/view/109801700>
FixedBrownfield Connectivity - Gateway
Update to V1.11 or later version Contact customer support to obtain the update <https://support.industry.siemens.com/cs/de/de/view/109801700>
FixedBrownfield Connectivity - Gateway
Update to V1.11 or later version Contact customer support to obtain the update <https://support.industry.siemens.com/cs/de/de/view/109801700>
FixedBrownfield Connectivity - Gateway
Update to V1.11 or later version Contact customer support to obtain the update <https://support.industry.siemens.com/cs/de/de/view/109801700>
FixedBrownfield Connectivity - Gateway
Update to V1.11 or later version Contact customer support to obtain the update <https://support.industry.siemens.com/cs/de/de/view/109801700>
FixedBrownfield Connectivity - Gateway
Update to V1.11 or later version Contact customer support to obtain the update <https://support.industry.siemens.com/cs/de/de/view/109801700>

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan