Outdated Components in ELSTER Rich-Client (ERiC) Version 37.2.6.0

[PeggyZhao]

Hi ERiC team,


Regarding ELSTER Rich-Client (ERiC) Version 37.2.6.0, we've conducted code scan with Black Duck Binary Analysic tool, please check below results for critical and high vulnerables. Is there any plan to upgrade the outdated components? Thank you.

BR
Peggy

[holzgoe]

Hallo PeggyZhao,

Please have a look here->https://www.elster.de/elsterweb/infoseite/entwickler

Tschüß

[PeggyZhao]

Hi ERiC team,
Please check more details in below table. Have you ever assessed if below vulnerabilities have impacted the library? If yes is there any plan to upgrade the outdated components?
Thank you.

Component Name	Version	Latest Version	Vulnerability	Date	CVSS v2	CVSS v3
curl	7.79.1	7.86.0	CVE-2022-32207	2022/07/07	7.5	9.8
			CVE-2022-27778	2022/06/02	5.8	8.1
			CVE-2022-22576	2022/05/26	5.5	8.1
			CVE-2022-27782	2022/06/02	5.0	7.5
			CVE-2022-27775	2022/06/02	5.0	7.5
			CVE-2022-27779	2022/06/02	5.0	5.3
			CVE-2022-27781	2022/06/02	5.0	7.5
			CVE-2022-27780	2022/06/02	5.0	7.5
			CVE-2022-32205	2022/07/07	4.3	4.3
			CVE-2022-32208	2022/07/07	4.3	5.9
			CVE-2022-32206	2022/07/07	4.3	6.5
			CVE-2022-27776	2022/06/02	4.3	6.5
			CVE-2022-30115	2022/06/02	4.0	4.3
			CVE-2022-27774	2022/06/02	3.5	5.7
			CVE-2022-32221	2022/12/05		9.8
			CVE-2022-35260	2022/12/05		6.5
			CVE-2022-42915	2022/10/29		9.8
			CVE-2022-42916	2022/10/28		7.5
			CVE-2022-35252	2022/09/23		3.7
openssl	3.0.2	3.0.7	CVE-2022-2068	2022/06/21	10.0	9.8
			CVE-2022-1292	2022/05/03	10.0	9.8
			CVE-2022-2097	2022/07/05	5.0	5.3
			CVE-2022-1473	2022/05/03	5.0	7.5
			CVE-2022-1343	2022/05/03	4.3	5.3
			CVE-2022-1434	2022/05/03	4.3	5.9
			CVE-2022-3996	2022/12/13		7.5
			CVE-2022-3602	2022/11/01		7.5
			CVE-2022-3786	2022/11/01		7.5
			CVE-2022-3358	2022/10/11		7.5
openssl	1.1.1n	3.0.7	CVE-2022-2068	2022/06/21	10.0	9.8
			CVE-2022-1292	2022/05/03	10.0	9.8
			CVE-2022-2097	2022/07/05	5.0	5.3
pcre2	10.35	10.40	CVE-2022-1586	2022/05/16	6.4	9.1
			CVE-2022-1587	2022/05/16	6.4	9.1
zlib	1.2.12	1.2.13	CVE-2022-37434	2022/08/04		9.8

Component Name	Version	Latest Version
libxml2	?	2.10.3
pcre2	?	10.40
boost	?	1.80.0
xerces-c++	?	3.2.4
xmlsec	?	1.2.37

[holzgoe]

Hallo PeggyZhao,

You have to register in the developer forum, only there you can be helped.

Tschüß

[PeggyZhao]

Hi Team,
Could you please provide link for developer forum? Thank you for your help.


BR
Peggy

[holzgoe]

Hallo PeggyZhao,

https://www.elster.de/elsterweb/infoseite/entwickler

Tschüß