In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network.
References
Link | Resource |
---|---|
https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf | Patch Vendor Advisory |
https://opcfoundation.org/security-bulletins/ | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-03-16T15:47:24
Updated: 2020-03-16T15:47:24
Reserved: 2019-11-20T00:00:00
Link: CVE-2019-19135
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-03-16T16:15:11.937
Modified: 2021-07-21T11:39:23.747
Link: CVE-2019-19135
JSON object: View
Redhat Information
No data.
CWE