The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

Note that Nessus relies on the presence of the package as reported by the vendor.

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions.
This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core - Server     Infrastructure (OpenSSL)). Supported versions that are affected are 22.10 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM.
    Successful attacks of this vulnerability can result in takeover of Siebel CRM. (CVE-2022-2274)

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing (Apache     Log4j)). Supported versions that are affected are 22.10 and prior. Difficult to exploit vulnerability     allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing.
    Successful attacks of this vulnerability can result in takeover of Siebel Apps - Marketing.
    (CVE-2021-44832)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This
    script is distributed by some operating systems in a manner where it is automatically executed. On such
    operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of
    the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool.
    Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n).
    Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd). (CVE-2022-1292)

  - In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances
    where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection
    were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other
    places in the script where the file names of certificates being hashed were possibly passed to a command
    executed through the shell. This script is distributed by some operating systems in a manner where it is
    automatically executed. On such operating systems, an attacker could execute arbitrary commands with the
    privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the
    OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in
    OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). (CVE-2022-2068)

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting
    the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect
    on such machines and memory corruption will happen during the computation. As a consequence of the memory
    corruption an attacker may be able to trigger a remote code execution on the machine performing the
    computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines
    supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

  - The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy
    check when doing certificate verification. However the implementation of the function does not enable the
    check which allows certificates with invalid or incorrect policies to pass the certificate verification.
    As suddenly enabling the policy check could break existing deployments it was decided to keep the existing
    behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to
    perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the
    policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument.
    Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.
    (CVE-2023-0466)

  - Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might
    corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64
    processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the
    OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application
    state might be corrupted with various application dependent consequences. The POLY1305 MAC (message
    authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on
    Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller
    all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is
    used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this
    kind of internal application state corruption can be various - from no consequences, if the calling
    application does not depend on the contents of non-volatile XMM registers at all, to the worst
    consequences, where the attacker could get complete control of the application process. However given the
    contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most
    likely consequence, if any, would be an incorrect result of some application dependent calculations or a
    crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the
    CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of
    this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether
    this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be
    potentially impacted. However we are currently not aware of any concrete application that would be
    affected by this issue therefore we consider this a Low severity security issue. As a workaround the
    AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable
    OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
    (CVE-2023-4807)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA73176 advisory.

  - AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt     the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was     preexisting in the memory that wasn't written. In the special case of in place encryption, sixteen bytes     of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and     DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q     (Affected 1.1.1-1.1.1p). (CVE-2022-2097)

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the January 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (OpenSSL)). The supported version that is     affected is 21.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTPS to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of     Oracle Essbase. (CVE-2022-2274)

  - Vulnerability in Oracle Essbase (component: Infrastructure (cURL)). The supported version that is affected     is 21.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to     compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle     Essbase. (CVE-2022-42915)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the Jan 2023 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Expat)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of     this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2022-25236)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module (Apache HTTP     Server)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of     this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2022-31813)     

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module (OpenSSL)).     The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of this vulnerability     can result in takeover of Oracle HTTP Server. (CVE-2022-2274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of openssl installed on the remote host is prior to 1.1.1q. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-186-01 advisory.

  - AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt     the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was     preexisting in the memory that wasn't written. In the special case of in place encryption, sixteen bytes     of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and     DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q     (Affected 1.1.1-1.1.1p). (CVE-2022-2097)

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.5 advisory.

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

  - AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt     the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was     preexisting in the memory that wasn't written. In the special case of in place encryption, sixteen bytes     of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and     DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q     (Affected 1.1.1-1.1.1p). (CVE-2022-2097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f0e45968-faff-11ec-856e-d4c9ef517024 advisory.

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.0.5-dev. It is, therefore, affected by a vulnerability as referenced in the 3.0.5-dev advisory.

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
251658	Linux Distros Unpatched Vulnerability : CVE-2022-2274	Nessus	Misc.	Local	critical
502993	Siemens SIMATIC Devices Linux Kernel Out-of-bounds Write (CVE-2022-2274)	Tenable OT Security	Tenable.ot	Remote	critical
212434	Oracle Siebel Server (January 2023 CPU)	Nessus	Misc.	Local	critical
406074	Alpine: openssl: security update to 0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
406074	Alpine: openssl: security update to 0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
182922	Juniper Junos OS Multiple Vulnerabilities (JSA73176)	Nessus	Junos Local Security Checks	Combined	critical
171320	Oracle Essbase (Jan 2023 CPU)	Nessus	Misc.	Local	critical
170268	Oracle HTTP Server (Jan 2023 CPU)	Nessus	Web Servers	Local	critical
162731	Slackware Linux 15.0 / current openssl Multiple Vulnerabilities (SSA:2022-186-01)	Nessus	Slackware Local Security Checks	Local	critical
162720	OpenSSL 3.0.0 < 3.0.5 Multiple Vulnerabilities	Nessus	Web Servers	Combined	critical
162699	FreeBSD : OpenSSL -- Heap memory corruption with RSA private key operation (f0e45968-faff-11ec-856e-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	Local	critical
162673	OpenSSL 3.0.4 < 3.0.5-dev Vulnerability	Nessus	Web Servers	Combined	critical

Detections

Analytics

CVE-2022-2274

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical