Quest KACE response to OpenSSL Security Advisory [7th February 2023] (4370413)

Quest KACE response to OpenSSL Security Advisory [7th February 2023]

There has been an OpenSSL Security Advisory concerning vulnerabilities which affect a version leveraged by KACE Systems Management Appliance (SMA) version 13.0 and KACE Systems Deployment Appliance (SDA) version 9.1:

X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)
Timing Oracle in RSA Decryption (CVE-2022-4304)
Use-after-free following BIO_new_NDEF (CVE-2023-0215)
Double free after calling PEM_read_bio_ex (CVE-2022-4450)

More information can be found here: https://www.openssl.org/news/secadv/20230207.txt

OpenSSL & FreeBSD were updated on the recent releases of the SMA (13.1) and SDA (9.2) to remediate the vulnerabilities reported for OpenSSL v1.1.1.