PT-2019-18111 · Citrix · Citrix Netscaler Gateway+1

Published 2019-02-22 · Updated 2020-08-24 · CVE-2019-6485

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Gateway versions 10.5 through 12.1 before build 50.31 Citrix Application Delivery Controller (ADC) versions 10.5 through 12.1 before build 50.31

Description The issue allows remote attackers to obtain sensitive plaintext information due to a TLS Padding Oracle Vulnerability when CBC-based cipher suites are enabled.

Recommendations For Citrix NetScaler Gateway versions 10.5 through 12.1 before build 50.31, update to build 50.31 or later. For Citrix Application Delivery Controller (ADC) versions 10.5 through 12.1 before build 50.31, update to build 50.31 or later.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2019-6485

Affected Products

Citrix Application Delivery Controller

Citrix Netscaler Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-6485 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6485 · Vendor Advisory
• https://support.citrix.com/article/CTX240139 · Vendor Advisory
• https://github.com/RUB-NDS/TLS-Padding-Oracles · Note
• http://securityfocus.com/bid/106783 · Note