Security advisory SA-2023-022 - OpenSSL OCB mode encryption flaw (CVE-2022-2097) is now available.
Summary
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.
Impact Details
| OS/Product |
Exposure |
| Extreme AirDefense |
No |
| Extreme Campus Controller (ExtremeCloud Appliance) |
No |
| Extreme Management Center (XMC) |
Yes |
| ExtremeAnalytics |
Yes |
| ExtremeCloud A3 |
No |
| ExtremeCloud IQ |
No |
| ExtremeConnect |
Yes |
| ExtremeControl |
Yes |
| ExtremeGuest (Essentials) |
No |
| ExtremeGuest (On-Premises) |
No |
| ExtremeLocation |
No |
| Fabric Manager |
Yes |
| Guest and IoT Manager (GIM) |
Yes |
| HiveManager Classic On-Premises |
No |
| HiveManager Classic Online |
No |
| IQ Engine (HiveOS) |
No |
| IQVA |
Yes |
| Traffic Sensor |
Yes |
| VGVA |
No |
| XIQ-SE |
Yes |
| 200-series |
Investigating |
| BOSS |
No |
| EOS (S/K/7100) |
Investigating |
| Fabric Engine (VOSS) |
No |
| ISW |
Investigating |
| Switch Engine (EXOS) |
No |
| Extreme Wireless (IdentiFi) |
No |
| Nsight |
No |
| WiNG |
Yes |
| Extreme Fabric Automation (EFA) |
No |
| Extreme Visibility Manager (XVM) |
Yes |
| NetIron OS |
No |
| Network OS |
No |
| SLX-OS |
No |
| Extreme SD-WAN |
No |
| Ipanema SALSA |
No |
| Ipanema SD-WAN Orchestrator |
No |
| Ipanema ip|engine |
No |
Repair Recommendations
Extreme Management Center (XMC):
- Fixed in 8.5.8 or later. (Target GA: June, 2023)
ExtremeAnalytics:
- Fixed in 22.6.12 and later.
ExtremeConnect:
- Fixed in 22.6.12 and later.
ExtremeControl:
- Fixed in 22.6.12 and later.
Fabric Manager:
- Fixed in 22.6.12 and later.
Guest and IoT Manager (GIM):
- Fixed in 22.6.12 and later.
Traffic Sensor:
- Fixed in 22.6.12 and later.
XIQ-SE:
- Fixed in 22.6.12 and later.
WiNG:
- Fixed in 7.7.1.5 and later.
- Fixed in 7.9.0.0 and later.
Extreme Visibility Manager (XVM):
- Upgrade to XCO 3.1.
Please see the full security advisory article here for more details.
