GN-SA-2023-001: Genian NAC - Multiple Vulnerabilities
=====================================================

Date
----
- Aug 15, 2023

Serverity
---------
- High

Summary
-------

The following vulnerabilities were identified related to the Genian Update server(s): 

- Missing Encryption of Sensitive Data vulnerability(CVE-2023-40251)
- Improper Control of Generation of Code (Code Injection) vulnerability(CVE-2023-40252)
- Improper Authentication vulnerability(CVE-2023-40253)
- Download of Code Without Integrity Check vulnerability(CVE-2023-40254)

.. note:: Server side actions were taken to mitigate threats, however, customers running the version(s) mentioned below are advised to update to the fixed version(s) as soon as possible. Not updating may leave customers vulnerable as well as prevent customer policy servers from obtaining the latest updates from the Genian Update server infrastructure.


Affected Products
-----------------
- Genian NAC 5.0.42 LTS (Revision 117460 or lower)
- Genian NAC 5.0.54 or lower
- Genian ZTNA 6.0.15 or lower

Affected Components
-------------------
- Policy Server
- Network Sensor
- Agent

Resolution
----------
The vulnerabilities contained in this advisory can be addressed by upgrading to version listed below:

- Genian NAC 5.0.42 LTS (Revision 117461 or higher)
- Genian NAC 5.0.55 or higher
- Genian ZTNA 6.0.16 or higher

Workaround
----------
- None