PT-2022-3348 · Openv2G · Openv2G

Published 2022-03-11 · Updated 2022-06-01 · CVE-2022-27242

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenV2G version 0.9.4

Description A vulnerability has been identified in the OpenV2G EXI parsing feature, which is missing a length check when parsing X509 serial numbers. This allows an attacker to introduce a buffer overflow, leading to memory corruption. The issue is related to the implementation of the EXI file parsing function, which can cause a buffer overflow when checking the length of X509 certificate serial numbers, potentially allowing an attacker to cause a denial of service.

Recommendations For OpenV2G version 0.9.4, consider disabling the EXI parsing feature until a patch is available to prevent potential buffer overflow attacks. Restrict access to the EXI parsing module to minimize the risk of exploitation. Avoid using the EXI parsing feature for X509 serial number parsing until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-04105

CVE-2022-27242

Affected Products

Openv2G

References · 8

• https://osv.dev/vulnerability/CVE-2022-27242 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-736385.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27242 · Security Note
• https://bdu.fstec.ru/vul/2022-04105 · Security Note
• https://github.com/Martin-P/OpenV2G · Note
• https://github.com/I2SE/openv2g/blob/master/README.txt · Note
• http://openv2g.sourceforge.net · Note
• https://t.me/cvenotify/30966 · Telegram Post