MEDIUM5.3

GHSA-8336-mxp6-v5h9

Moderate severity vulnerability that affects OPCFoundation.NetStandard.Opc.Ua

Quick fix

GHSA-8336-mxp6-v5h9 — OPCFoundation.NetStandard.Opc.Ua: upgrade to the fixed version with the command below.

dotnet add package OPCFoundation.NetStandard.Opc.Ua --version 1.4.353.15

Details

Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over a piece of network infrastructure to decrypt passwords.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/OPCFoundation.NetStandard.Opc.Ua

Introduced in: 0Fixed in: 1.4.353.15

Fixdotnet add package OPCFoundation.NetStandard.Opc.Ua --version 1.4.353.15

References

https://nvd.nist.gov/vuln/detail/CVE-2018-12087[ADVISORY]
https://github.com/advisories/GHSA-8336-mxp6-v5h9[ADVISORY]
https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12087.pdf[WEB]