Phoenix Contact: Unbounded growth of OpenSSL session cache in multiple FL MGUARD devices
Advisory ansehen veröffentlicht 2024-06-11
The OpenSSL library used in the affected products is vulnerable to an unbounded growth of the session cache in the TLSv1.3 implementation.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-2511US | — | — | ||
Issue summary: Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions
Impact summary: An attacker may exploit certain server… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2024-029: Phoenix Contact: Unbounded growth of OpenSSL session cache in multiple FL MGUARD devices - HTMLself
- CERT@VDE Security Advisories for Phoenix Contact GmbH & Co. KGexternal
- Vendor PSIRTexternal
- VDE-2024-029: Phoenix Contact: Unbounded growth of OpenSSL session cache in multiple FL MGUARD devices - CSAFself
03
Behebungen (2)
- Mitigation
Phoenix Contact recommends that customers restrict network access to the device's web interface to as few networks as possible.
- Behoben
Phoenix Contact recommends upgrading the firmware of affected devices to version 1.8.0, which fixes the vulnerability.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan