Insyde's Security Pledge

Recent Security Advisories

INSYDE-SA-2023029

Product

CVSS Score

Original Date

Last Revised

InsydeH2O

5.9-7.4

2023-05-09

Summary

Code change to accommodate OpenSSL 1.1.1t.

Vulnerability Details

CVSS Vector: Multiple

InsydeH2O code change to accommodate OpenSSL 1.1.1t and fix the following vulnerabilities.

  1. CVE-2023-0286
    CVSS:7.4
    Description: X.400 address type confusion in X.509 GeneralName
  2. CVE-2022-4304
    CVSS:5.9
    Description: Timing Oracle in RSA Decryption
  3. CVE-2023-0215
    CVSS:5.9
    Description: Use-after-free following BIO_new_NDEF
  4. CVE-2022-4450
    CVSS:5.9
    Description: Double free after calling PEM_read_bio_ex

Solution Information

kernel 5.0: unaffected
kernel 5.1: unaffected
kernel 5.2: unaffected
kernel 5.3: Version 05.37.07
kernel 5.4: Version 05.45.07
kernel 5.5: Version 05.53.07

Acknowledgements

Revision History

Revision #

Date

Description

1

2023-05-09

Initial Release