TRUMPF: Oseon contains vulnerable version of OpenSSL 1.1.x
Multiple vulnerabilities in the included versions of OpenSSL can lead to different problems, including crashes of the OpenSSL modules (leading to a Denial of Service) or leakage of plaintext. These underlying vulnerabilities can be fixed by installing a software update provided by TRUMPF.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-2097US | medium5.3OT erhöht | Exploit | ||
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixte… | ||||
| CVE-2021-3711US | critical9.8 | — | ||
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first tim… | ||||
| CVE-2021-23840US | high7.5 | Exploit | ||
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (3)
- MitigationOseon
Please contact your TRUMPF Service with the PR number 500876.
- MitigationOseon
Please contact your TRUMPF Service with the PR number 500876.
- MitigationOseon
Please contact your TRUMPF Service with the PR number 500876.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan