TRUMPF: Oseon contains vulnerable version of OpenSSL 1.1.x
view advisory published 2024-01-23
Multiple vulnerabilities in the included versions of OpenSSL can lead to different problems, including crashes of the OpenSSL modules (leading to a Denial of Service) or leakage of plaintext. These underlying vulnerabilities can be fixed by installing a software update provided by TRUMPF.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-2097US | medium5.3OT elevated | Exploit | ||
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixte… | ||||
| CVE-2021-3711US | critical9.8 | — | ||
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first tim… | ||||
| CVE-2021-23840US | high7.5 | Exploit | ||
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (3)
- MitigationOseon
Please contact your TRUMPF Service with the PR number 500876.
- MitigationOseon
Please contact your TRUMPF Service with the PR number 500876.
- MitigationOseon
Please contact your TRUMPF Service with the PR number 500876.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan