Phoenix Contact: Unbounded growth of OpenSSL session cache in multiple FL MGUARD devices
view advisory published 2024-06-11
The OpenSSL library used in the affected products is vulnerable to an unbounded growth of the session cache in the TLSv1.3 implementation.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-2511US | — | — | ||
Issue summary: Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions
Impact summary: An attacker may exploit certain server… | ||||
02
references
External citations — patches, advisories, analysis.
- VDE-2024-029: Phoenix Contact: Unbounded growth of OpenSSL session cache in multiple FL MGUARD devices - HTMLself
- CERT@VDE Security Advisories for Phoenix Contact GmbH & Co. KGexternal
- Vendor PSIRTexternal
- VDE-2024-029: Phoenix Contact: Unbounded growth of OpenSSL session cache in multiple FL MGUARD devices - CSAFself
03
remediations (2)
- Mitigation
Phoenix Contact recommends that customers restrict network access to the device's web interface to as few networks as possible.
- Fixed
Phoenix Contact recommends upgrading the firmware of affected devices to version 1.8.0, which fixes the vulnerability.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan