TI-2022-08285 Aliases CVE-2022-24409 GHSA-qrhr-42fp-q7c4

Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may…

LOW 35CWE-385Published 2022-02-23 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may be exploited by malicious users to compromise the affected system. Only customers with active BSAFE maintenance contracts can receive details about this vulnerability. Public disclosure of the vulnerability details will be shared at a later date.

Why it matters now

EPSS 0.00962 61st percentileScored 2026-11-07

Fix Fixed Dell BSAFE SSL-J (Dell): 6.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Dell BSAFE SSL-J	5.1 and later; before 6.4	6.4	Patch available	CNA

Dell BSAFE SSL-J VendorDell Affected 5.1 and later; before 6.4 Fixed in 6.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:bsafe_ssl-j::::::::	6.1.0 to before 6.4	Vulnerable	Dell

cpe:2.3:a:dell:bsafe_ssl-j:*:*:*:*:*:*:*:* Versions 6.1.0 to before 6.4 Vulnerable ·Dell

Remediation

Fix · CNA Dell BSAFE SSL-J (Dell) Fixed in 6.4

Timeline

2026-10-02 Threatist record created from CVE-2022-24409
2026-10-03 Alias added: GHSA-qrhr-42fp-q7c4

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000196312/dsa-2022-023-dell-bsafetm-ssl-j-6-4-security-update-for-a-single-covert-timing-channel

TI-2022-15280 Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J… CVSS 3.1CRITICAL 9.8
TI-2004-00066 The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c… CVSS 3.1HIGH 7.5
TI-2001-01060 RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1, as used in Cisco iCND 2.0, caches session IDs from… CVSS 2.0HIGH 7.5
TI-2015-00494 EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA… CVSS 3.1HIGH 7.5
TI-2019-02759 Cryptographic flaw in Dell RSA BSAFE Crypto-J CVSS 3.1MEDIUM 6.5
TI-2004-00095 The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos… CVSS 2.0MEDIUM 5.0

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences