VDE-2022-013

PHOENIX CONTACT: Multiple products affected by possible infinite loop within OpenSSL library

FL MGUARD and TC MGUARD devices are affected by a possible infinite loop within a OpenSSL library method for parsing elliptic curve parameters. This method is used on parsing cryptographic certificates that contain elliptic curve public keys in compressed form, which may occur on: Parsing client certificates for HTTPS administrative login Parsing client certificates for SSH administrative login Parsing peer certificates for IPsec VPN connections Parsing certificates of external servers, including: OpenVPN server Configuration pull server Update server Attackers could try to exploit the vulnerability from remote. For the mGuard Device Manager only the mdm Installer for Windows is affected. UPDATE A: Added FL MGUARD 1102 and FL MGUARD 1105: On FL MGUARD 1102 and FL MGUARD 1105 with mGuardNT 1.5.2 and older, the device can be affected through an adapted certificate. This can occur on connection with a remote logging server, configured for certificate authentication, or an remote authentication server at certificate based authentication.