SSA-028723: Multiple OpenSSL Vulnerabilities in BFCClient Before V2.17
Siemens BFCClient contains multiple vulnerabilities in the integrated OpenSSL component that could allow an attacker to read memory contents, to change the application behaviour or to create a denial of service condition. Siemens has released a new version for BFCClient and recommends to update to the latest version.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-0464US | high7.5 | Exploit | ||
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints. Attacke… | ||||
| CVE-2023-0286US | high7.4 | — | ||
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure def… | ||||
| CVE-2022-0778US | high7.5 | Exploit | ||
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi… | ||||
| CVE-2021-3712US | high7.4 | Exploit | ||
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This cont… | ||||
| CVE-2021-3711US | critical9.8 | — | ||
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first tim… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- MitigationBFCClient
Disable CRL (certification revocation list) checking, if possible
- FixedBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
- FixedBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
- FixedBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
- FixedBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
- FixedBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan