| Package | Affected versions | Patched versions |
|---|---|---|
| curl | ≥ 7.61.0, ≤ 7.76.1 | |
| communications cloud native core binding support function | = 1.11.0 | |
| communications cloud native core network function cloud native environment | = 1.10.0 | |
| communications cloud native core network repository function | = 1.15.0= 1.15.1 | |
| communications cloud native core network slice selection function | = 1.8.0 | |
| communications cloud native core service communication proxy | = 1.15.0 | |
| essbase | ≥ 21.0, < 21.3< 11.1.2.4.047 | 21.311.1.2.4.047 |
| mysql server | ≥ 8.0.0, ≤ 8.0.25≤ 5.7.34 | |
| sinec infrastructure network services | < 1.0.1.1 | 1.0.1.1 |
| universal forwarder | = 9.1.0≥ 8.2.0, < 8.2.12≥ 9.0.0, < 9.0.6 | 8.2.129.0.6 |
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free