PT-2022-19393 · Fortinet · Fortiproxy+1

Published 2022-09-06 · Updated 2022-09-09 · CVE-2022-29053

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.0.0 through 7.2.0 FortiOS versions below 7.0.0

Description A missing cryptographic steps issue in the functions that encrypt keytab files may allow an attacker in possession of the encrypted file to decipher it. This affects the encryption of keytab values in FortiOS and FortiProxy.

Recommendations For FortiOS versions 7.0.0 through 7.2.0, update to a version that includes the necessary cryptographic steps to secure keytab files. For FortiOS versions below 7.0.0, update to a version that includes the necessary cryptographic steps to secure keytab files. As a temporary workaround, consider restricting access to the encrypted keytab files until a patch is available.

Fix

Related Identifiers

CVE-2022-29053

Affected Products

Fortios

Fortiproxy

References · 6

• https://osv.dev/vulnerability/CVE-2022-29053 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-22-158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29053 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29053 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-22-158 · Note
• https://t.me/cibsecurity/49334 · Telegram Post