Edge SWG (formerly ProxySG) vulnerability status in respect to CVE-2024-3296

Products

• ProxySG Software - SGOS
• ISG Proxy
• SG-VA
• SG-S500
• SG-S500-RP
• SG-S400-RP
• SG-S400
• SG-S200-RP
• SG-S200
• SG-S200-40

Issue/Introduction

Proxy administrators would like to determine if Edge SWG (formerly ProxySG) devices are vulnerable to CVE-2024-3296.

Environment

Edge SWG (formerly ProxySG)

Cause

Vulnerability Details

CVE ID Number: CVE-2024-3296
Component: OpenSSL
Summary: PKCS Decoding crashes
Date Published: April 4th, 2024
Description: A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages for decryption. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
Vector Assessment: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 5.9 (Medium)

Advisory Link(s)

• https://nvd.nist.gov/vuln/detail/CVE-2024-3296 

Resolution

Edge SWG (formerly ProxySG) devices are not vulnerable to CVE-2024-3296.