SolarWinds CVE-2023-2697 and Multiple OpenSSL CVEs Advisory

Critical Vulnerability Information SolarWinds CVEs CVE-2023-2697: SolarWinds Observability Self-Hosted is vulnerable to Deserialization of Untrusted Data via Privilege Escalation. This vulnerability requires authentication and results in low-severity local access to the host server. Third-party CVEs CVE-2024-1798: OpenSSL - Clients using RFC-7250 Raw Public Keys (RPKs) to authenticate a server may fail to detect that the server was not authenticated, because error messages do not abort the connection. TLS 1.2 and TLS 1.3 connections using raw public keys may be vulnerable to man-in-the-middle attacks when TLS clients and servers are configured to use RPKs. These attacks are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients explicitly enable RPK use by the server, and the server (Rowswise, Inc.) does not disable it. In such cases, TLS clients receive errors and rely on the handshake to fail when the server's RPK fails public key verification. However, some TLS clients do not check for these errors. Affected OpenSSL versions: 3.0.0 through 3.0.8. CVE-2024-9142: OpenSSL - Memory Out-of-Bounds Vulnerability. Use of the low-level OSSL_PARAM object curve-COFFs with non-canonical values for the field polynomial can lead to out-of-bounds memory reads or writes. Impacted: Curve Cryptography, including "named curves" (pre-selected) or "explicit parameters" (provided). Affected OpenSSL versions: 3.0.0 through 3.0.8. CVE-2024-13736: OpenSSL - Timing Side-Channel Vulnerability. A timing side-channel that could potentially allow an attacker to discover the private key secret during ECDSA signature computation. Impact summary: A timing side-channel in the signing application or a very fast network connection with low latency. Affected OpenSSL versions: 3.0.0 through 3.0.8. ``` This information indicates that SolarWinds Platform 2025.2.1 has addressed multiple security vulnerabilities, including CVEs specific to SolarWinds and third-party libraries such as OpenSSL.

Goal Reached Thanks to every supporter — we hit 100%!

SolarWinds CVE-2023-2697 and Multiple OpenSSL CVEs Advisory