CVE-2023-0215 json
Use-after-free following BIO_new_NDEF
published 2023-02-07 3 y ago modified 2026-10-14 25 d ago also EUVD-2023-0789 , GHSA-r7jw-wp68-3xch , JLSEC-2026-233 , RUSTSEC-2023-0009
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.0%
- EPSS 5.0% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.
The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.
This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.
Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream.
The OpenSSL cms and smime command line applications are similarly affected.
Patch / fix
- crates.io openssl-src 111.25.0, 300.0.12
- julia OpenSSL_jll 1.1.20+0
- julia Openresty_jll 1.27.1+0
- OpenSSL OpenSSL 1.0.2zg, 1.1.1t, 3.0.8
- Siemens SCALANCE W1750D (JP) V8.10.0.9
- Siemens SCALANCE W1750D (ROW) V8.10.0.9
- Siemens SCALANCE W1750D (USA) V8.10.0.9
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- openssl Debian 14, Debian 13, Debian 12 3.0.8-1
debian advisories DEBIAN-CVE-2023-0215
- edk2 Ubuntu 22.04 LTS 2022.02-3ubuntu0.22.04.4
- nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.3
- openssl Ubuntu 18.04 LTS 1.1.1-1ubuntu2.1~18.04.21
- openssl Ubuntu 20.04 LTS 1.1.1f-1ubuntu2.17
- openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.8
- openssl1.0 Ubuntu 18.04 LTS 1.0.2n-1ubuntu5.11
- openssl Ubuntu Pro 14.04 LTS 1.0.1f-1ubuntu2.27+esm6
- openssl Ubuntu Pro 16.04 LTS 1.0.2g-1ubuntu4.20+esm6
ubuntu advisories UBUNTU-CVE-2023-0215
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- edk2 RHEL 8 20220126gitbb1bba3d77-4.el8
- edk2-ovmf RHEL 8 20220126gitbb1bba3d77-4.el8
- edk2-aarch64 RHEL 8 20220126gitbb1bba3d77-4.el8
- openssl RHEL 9 1:3.0.1-47.el9_1
- openssl-libs RHEL 9 1:3.0.1-47.el9_1
- openssl-perl RHEL 9 1:3.0.1-47.el9_1
- edk2 RHEL 9 20221207gitfff6d81270b5-9.el9_2
- edk2-ovmf RHEL 9 20221207gitfff6d81270b5-9.el9_2
red hat advisories RHSA-2023:2932RHSA-2023:1199RHSA-2023:0946RHSA-2023:2165RHSA-2023:4128RHSA-2023:3354
- openssl SLES 12 SP2-BCL 1.0.2j-60.86.1
- openssl-3 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 3.0.1-150400.4.17.1
- openssl-1_1 SLE Module for Basesystem 15 SP4, SLE Micro 5.3, openSUSE Leap Micro 5.3 +1 more 1.1.1l-150400.7.22.1
- openssl-1_1 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +13 more 1.1.1d-150200.11.57.1
- openssl-1_1 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.1.1d-2.75.1
- openssl-1_0_0 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.0.2p-3.64.1
- openssl-1_0_0 SLE Module for Legacy 15 SP4, SLE High Performance Computing 15 SP3-ESPOS, openSUSE Leap 15.4 +9 more 1.0.2p-150000.3.65.1
- openssl-1_1 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 1.1.0i-150100.14.42.1
suse advisories SUSE-SU-2023:0684-1SUSE-SU-2023:0312-1SUSE-SU-2023:0311-1SUSE-SU-2023:0310-1SUSE-SU-2023:0309-1SUSE-SU-2023:0308-1
- openssl-1_0_0 openSUSE Tumbleweed 1.0.2u-12.1
- openssl-1_1 openSUSE Tumbleweed 1.1.1t-1.1
- openssl-3 openSUSE Tumbleweed 3.0.8-1.1
opensuse advisories openSUSE-SU-2024:12687-1openSUSE-SU-2024:12688-1openSUSE-SU-2024:12716-1
- edk2-ovmf AlmaLinux 8 20220126gitbb1bba3d77-4.el8
- edk2-aarch64 AlmaLinux 8 20220126gitbb1bba3d77-4.el8
- edk2-ovmf AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
- edk2-tools AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
- edk2-aarch64 AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
- openssl AlmaLinux 8 1:1.1.1k-9.el8_7
- openssl-libs AlmaLinux 8 1:1.1.1k-9.el8_7
- openssl-perl AlmaLinux 8 1:1.1.1k-9.el8_7
almalinux advisories ALSA-2023:2932ALSA-2023:2165ALSA-2023:1405ALSA-2023:0946
- openssl Rocky Linux 9 1:3.0.1-47.el9_1
- openssl Rocky Linux 8 1:1.1.1k-9.el8_7
rocky linux advisories RLSA-2023:0946RLSA-2023:1405
- openssl Alpine 3.16, Alpine 3.15, Alpine 3.14 1.1.1t-r0
- openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.0.8-r0
- openssl3 Alpine 3.16, Alpine 3.15 3.0.8-r0
- openssl1.1-compat Alpine 3.18, Alpine 3.17 1.1.1t-r0
alpine advisories ALPINE-CVE-2023-0215
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- cloud-hypervisor CBL-Mariner 2.0 30.0-2
- openssl CBL-Mariner 2.0 1.1.1k-21
- hvloader CBL-Mariner 2.0 1.0.1-2
- hvloader Azure Linux 3.0 1.0.1-4
azure linux advisories AZL-13301AZL-13352AZL-37641AZL-37898
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-0215 updated cvss 7.5
openssl: use-after-free following BIO_new_NDEF
-
Red Hat Enterprise Linux 6 openssl, openssl-perl Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF, openssl, openssl-libs, openssl-perlaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 compat-openssl10 Red Hat Enterprise Linux 9 shim, shim-x64, shim-aa64, compat-openssl11affected: no fix planned “Will not fix”
-
Red Hat JBoss Web Server 3 opensslaffected: no fix planned “Out of support scope”
-
Red Hat JBCS httpd 2.4.51.sp2fixed: vendor fix RHSA-2023:3355
-
Red Hat Enterprise Linux AppStream (v. 8) edk2 20220126gitbb1bba3d77-4.el8, edk2-ovmf 20220126gitbb1bba3d77-4.el8, edk2-aarch64 20220126gitbb1bba3d77-4.el8fixed: vendor fix RHSA-2023:2932
-
Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.0.1-47.el9_1, edk2 20221207gitfff6d81270b5-9.el9_2, edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2fixed: vendor fix RHSA-2023:0946
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) edk2 20220126gitbb1bba3d77-2.el8_6.1, edk2-ovmf 20220126gitbb1bba3d77-2.el8_6.1, edk2-aarch64 20220126gitbb1bba3d77-2.el8_6.1fixed: vendor fix RHSA-2023:4128
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) openssl-perl 3.0.1-46.el9_0fixed: vendor fix RHSA-2023:1199
show 9 moreshow fewer
-
Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1k-9.el8_7, openssl-libs 1.1.1k-9.el8_7, openssl-perl 1.1.1k-9.el8_7fixed: vendor fix RHSA-2023:1405
-
Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.0.1-47.el9_1, openssl-libs 3.0.1-47.el9_1fixed: vendor fix RHSA-2023:0946
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) openssl 1.1.1k-9.el8_6, openssl-libs 1.1.1k-9.el8_6, openssl-perl 1.1.1k-9.el8_6fixed: vendor fix RHSA-2023:3408
-
Red Hat Enterprise Linux BaseOS EUS (v.9.0) openssl 3.0.1-46.el9_0, openssl-libs 3.0.1-46.el9_0fixed: vendor fix RHSA-2023:1199
-
Red Hat Enterprise Linux CRB (v. 9) edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-tools 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2fixed: vendor fix RHSA-2023:2165
-
Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-openssl 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-openssl 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el8jbcsfixed: vendor fix RHSA-2023:3354
-
Red Hat JBoss Web Server 5fixed: vendor fix RHSA-2023:3421
-
Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native 1.2.31-14.redhat_14.el7jws Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native 1.2.31-14.redhat_14.el8jws Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native 1.2.31-14.redhat_14.el9jwsfixed: vendor fix RHSA-2023:3420
-
Red Hat Enterprise Linux 8 shim, shim-x64, shim-aa64, shim-ia32 Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl 8.0.1-1.el7jbcs, jbcs-httpd24-httpd 2.4.51-39.el7jbcs, jbcs-httpd24-libcurl 8.0.1-1.el7jbcs, jbcs-httpd24-mod_md 2.4.0-20.el7jbcs, jbcs-httpd24-mod_ssl 2.4.51-39.el7jbcs, jbcs-httpd24-apr-util 1.6.1-101.el7jbcs, +20 more Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl 8.0.1-1.el8jbcs, jbcs-httpd24-httpd 2.4.51-39.el8jbcs, jbcs-httpd24-libcurl 8.0.1-1.el8jbcs, jbcs-httpd24-mod_md 2.4.0-20.el8jbcs, jbcs-httpd24-mod_ssl 2.4.51-39.el8jbcs, jbcs-httpd24-apr-util 1.6.1-101.el8jbcs, +20 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-23-348-10 updated cvss 5.9
Siemens SIMATIC S7-1500
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5affected: fixed in V3.1.5, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-23-194-04 updated cvss 5.9
Siemens SIMATIC MV500 Devices
-
Siemens SIMATIC MV540 H (6GF3540-0GE10) <V3.3.4 Siemens SIMATIC MV540 S (6GF3540-0CD10) <V3.3.4 Siemens SIMATIC MV550 H (6GF3550-0GE10) <V3.3.4 Siemens SIMATIC MV550 S (6GF3550-0CD10) <V3.3.4 Siemens SIMATIC MV560 U (6GF3560-0LE10) <V3.3.4 Siemens SIMATIC MV560 X (6GF3560-0HE10) <V3.3.4affected: fixed in V3.3.4 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-25-044-09 updated cvss 5.9
Siemens SCALANCE W700 IEEE 802.11ax
-
Siemens SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) <V3.0.0 Siemens SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) <V3.0.0 Siemens SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) <V3.0.0 Siemens SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) <V3.0.0 Siemens SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) <V3.0.0affected: fixed in V3.0.0 support.industry.siemens.com
+13 more productsfewer
Siemens SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) <V3.0.0 Siemens SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) <V3.0.0 Siemens SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) <V3.0.0 Siemens SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) <V3.0.0 Siemens SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) <V3.0.0 Siemens SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) <V3.0.0
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-25-065-01 updated cvss 7.5
Hitachi Energy PCU400
-
Hitachi Energy PCU400 <=6.5_K, <=9.4.1affected: fixed in 6.6.0
-
Hitachi Energy PCULogger <=1.1.0affected: no fix planned
-
Hitachi Energy PCU400 6.6.0, 9.4.2 Hitachi Energy PCULogger 1.2.0fixed
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-205-02 updated cvss 7.5
Hitachi Energy AFS/AFR Series Products
-
Hitachi Energy AFR677 <=9.1.08 Hitachi Energy AFS650 <=9.1.08 Hitachi Energy AFS660-C <=7.1.05 Hitachi Energy AFS665-B <=7.1.05 Hitachi Energy AFS670 <=9.1.08 Hitachi Energy AFS670-V2 <=7.1.05affected: vendor fix, mitigation “Hitachi Energy has released the following mitigations/fixes:” publisher.hitachienergy.com
+2 more productsfewer
Hitachi Energy AFS675 <=9.1.08 Hitachi Energy AFS677 <=9.1.08
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
cisa ICSA-24-165-06 updated cvss 5.9
Siemens TIM 1531 IRC
-
Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) <V2.4.8 Siemens TIM 1531 IRC (6GK7543-1MX00-0XE0) <V2.4.8affected: fixed in V2.4.8 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-165-10 updated cvss 5.9
Siemens SIMATIC and SIPLUS
-
Siemens SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) <V2.3 Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) <V2.3 Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) <V2.3affected: fixed in V2.3 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-165-11 updated cvss 5.9
Siemens SCALANCE XM-400, XR-500
-
Siemens SCALANCE XM408-4C (6GK5408-4GP00-2AM2) <V6.6.1 Siemens SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (6GK5408-8GS00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (6GK5416-4GS00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2) <V6.6.1affected: fixed in V6.6.1 support.industry.siemens.com
+20 more productsfewer
Siemens SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (6GK5528-0AA00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (6GK5552-0AA00-2AR2) <V6.6.1
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-23-075-04 updated cvss 5.9
Siemens SCALANCE W1750D Devices
-
Siemens SCALANCE W1750D (JP) (6GK5750-2HX01-1AD0) <V8.10.0.9 Siemens SCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0) <V8.10.0.9 Siemens SCALANCE W1750D (USA) (6GK5750-2HX01-1AB0) <V8.10.0.9affected: fixed in V8.10.0.9
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-23-166-11 updated cvss 5.9
Siemens SIMATIC S7-1500 TM MFP Linux Kernel
-
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem <V1.1affected: fixed in V1.1, workaround support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-046-15 updated cvss 5.9
Siemens SINEC NMS
-
Siemens SINEC NMS <V2.0_SP1affected: fixed in V2.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-23-255-01 updated cvss 7.5
Hitachi Energy Lumada APM Edge
-
Hitachi Energy Lumada APM Edge <= 4.0, 6.3affected: vendor fix, mitigation “For more information, see Hitachi Energy advisory 8DBD000169.” search.abb.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
5.02% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | openssl-src | <111.25.0 >=300.0.0, <300.0.12 >=0.0.0-0, <111.25.0 |
111.25.0 300.0.12 |
| julia | OpenSSL_jll | <1.1.20+0 |
1.1.20+0 |
| julia | Openresty_jll | <1.27.1+0 |
1.27.1+0 |
Affected products
- OpenSSL OpenSSL
- Siemens SCALANCE W1750D (JP)
- Siemens SCALANCE W1750D (ROW)
- Siemens SCALANCE W1750D (USA)
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
-
- CWE-416 Use After Free
- Technology feeds
References
-
git.openssl.org
/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd
patch, web, vendor-advisory
-
git.openssl.org
/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344
patch, web, vendor-advisory
-
git.openssl.org
/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb
patch, web, vendor-advisory
-
openssl.org
/news/secadv/20230207.txt
vendor-advisory, web
-
security.netapp.com
/advisory/ntap-20230427-0007/
third-party-advisory, web
-
security.netapp.com
/advisory/ntap-20230427-0009/
third-party-advisory, web
-
security.gentoo.org
/glsa/202402-08
web
-
security.netapp.com
/advisory/ntap-20240621-0006/
web
-
psirt.global.sonicwall.com
/vuln-detail/SNWLID-2023-0003
web
- cert-portal.siemens.com /productcert/html/ssa-203374.html
- cert-portal.siemens.com /productcert/html/ssa-794697.html
- cert-portal.siemens.com /productcert/html/ssa-561322.html
- cert-portal.siemens.com /productcert/html/ssa-398330.html
- cert-portal.siemens.com /productcert/html/ssa-943925.html
- cert-portal.siemens.com /productcert/html/ssa-556635.html
- cert-portal.siemens.com /productcert/html/ssa-879734.html
- cert-portal.siemens.com /productcert/html/ssa-625862.html
- cert-portal.siemens.com /productcert/html/ssa-337522.html
- cert-portal.siemens.com /productcert/html/ssa-769027.html
-
nvd.nist.gov
/vuln/detail/CVE-2023-0215
advisory, web
-
rustsec.org
/advisories/RUSTSEC-2023-0009.html
web, advisory
-
security.netapp.com
/advisory/ntap-20230427-0007
web
-
security.netapp.com
/advisory/ntap-20230427-0009
web
-
security.netapp.com
/advisory/ntap-20240621-0006
web
-
github.com
/advisories/GHSA-r7jw-wp68-3xch
web
-
crates.io
/crates/openssl-src
package
Sources
- CVE List CVE-2023-0215
- GitHub Advisory GHSA-r7jw-wp68-3xch
- NVD CVE-2023-0215
- OSV JLSEC-2026-233
- OSV RUSTSEC-2023-0009
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.