CVE-2022-1434: openssl from 3.0.0 (inclusive), before 3.0.3 (exclusive); +30 more affected products

Affected technology

openssl · from 3.0.0 (inclusive), before 3.0.3 (exclusive)
openssl

active iq unified manager · Version not applicable in the source CPE
netapp

clustered data ontap · Version not applicable in the source CPE
netapp

clustered data ontap antivirus connector · Version not applicable in the source CPE
netapp

santricity smi-s provider · Version not applicable in the source CPE
netapp

smi-s provider · Version not applicable in the source CPE
netapp

snapmanager · Version not applicable in the source CPE
netapp

solidfire, enterprise sds & hci storage node · Version not applicable in the source CPE
netapp

solidfire & hci management node · Version not applicable in the source CPE
netapp

a700s firmware · Version not applicable in the source CPE
netapp

h300s firmware · Version not applicable in the source CPE
netapp

h500s firmware · Version not applicable in the source CPE
netapp

h700s firmware · Version not applicable in the source CPE
netapp

h300e firmware · Version not applicable in the source CPE
netapp

h500e firmware · Version not applicable in the source CPE
netapp

h700e firmware · Version not applicable in the source CPE
netapp

h410s firmware · Version not applicable in the source CPE
netapp

aff 8300 firmware · Version not applicable in the source CPE
netapp

fas 8300 firmware · Version not applicable in the source CPE
netapp

aff 8700 firmware · Version not applicable in the source CPE
netapp

fas 8700 firmware · Version not applicable in the source CPE
netapp

aff a400 firmware · Version not applicable in the source CPE
netapp

fabric-attached storage a400 firmware · Version not applicable in the source CPE
netapp

a250 firmware · Version not applicable in the source CPE
netapp

aff 500f firmware · Version not applicable in the source CPE
netapp

fas 500f firmware · Version not applicable in the source CPE
netapp

OpenSSL · Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2)
OpenSSL

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · 0 to before V1.1
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. NVD’s CVSS 3.1 assessment (base score 5.9/10) rates confidentiality and availability impact as none; integrity impact as high.