The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the name (e.g. CERTIFICATE), any header data and the payload data. If the function succeeds then the name_out, header and data arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Detections

Analytics

Siemens SIMATIC and SCALANCE Products Encryption Strength (CVE-2022-4450)

high Tenable OT Security Plugin ID 501842

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.8 Oct 29, 2025, 8:57 PM New Plugin Feed: 202510292057
Version 1.7 Mar 17, 2025, 10:32 PM New Plugin Feed: 202503172232
Version 1.6 Feb 25, 2025, 7:13 PM New Plugin Feed: 202502251913
Version 1.5 Feb 24, 2025, 3:01 PM New Plugin Feed: 202502241501
Version 1.4 Sep 5, 2024, 5:04 AM Plugin metadata (Add CISA's ICSA Reference Information tag) Plugin Feed: 202409050504
Version 1.3 Jul 23, 2024, 6:09 PM New Plugin Feed: 202407231809
Version 1.2 Apr 13, 2024, 2:49 PM New Plugin Feed: 202404131449
Version 1.1 Dec 19, 2023, 8:16 PM CVSS metrics ("CVSSv2 score" set to 7.8. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C". "CVSSv3 score" set to 7.5. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H") CVSSv2 severity (based on CVE-2022-4450, severity increased from "Medium" to "High") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Plugin Feed: 202312192016
Version 1.0 Dec 19, 2023, 11:02 AM New Plugin Feed: 202312191102