SEP2 would like to advise of a newly discovered vulnerability that has been found in Check Point software. Whilst this is not a direct result of code created by Check Point Software Technologies Ltd themselves, this is a vulnerability identified in an external software package used within the Gaia operating system and must be patched immediately to prevent CVE-2022-4450 and CVE-2022-4304 from being actively exploited.

CVE-2022-4450: An OpenSSL vulnerability was discovered that enables the initiation of a Denial of Service (DoS) attack by submitting malicious PEM files for parsing. Because certificate parsing precedes certificate signature verification, a process that parses an externally supplied certificate could be subject to a denial of service attack.

CVE-2022-4304: An OpenSSL vulnerability was discovered that enables the potential to initiate a timing-based side channel within the RSA Decryption implementation. This could be exploited to recover plaintext information over a network, following a Bleichenbacher-style attack methodology.

The vulnerability release page can be found on Check Point’s website here.

This problem was fixed. The fix is included starting from:

✅ Jumbo Hotfix Accumulator for R81.20 starting from Take 26
✅ Jumbo Hotfix Accumulator for R81.10 starting from Take 110
✅ R81.10.08 for Quantum Spark Appliances

Please ensure you are patched to the relevant levels as fast as you can. Speak to the SEP2 team to learn more or for any assistance.