CVE-2018-7559

Name of the Vulnerable Software and Affected Versions: OPC UA .NET Standard Stack and Sample Code versions before GitHub commit 2018-04-12 OPC UA .NET Legacy Stack and Sample Code versions before GitHub commit 2018-03-13

Description: A vulnerability in OPC UA applications allows a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack. The issue is related to errors in managing cryptographic keys, which can allow an attacker to disclose protected information.

Recommendations: For OPC UA .NET Standard Stack and Sample Code versions before GitHub commit 2018-04-12, update to a version after GitHub commit 2018-04-12 to resolve the issue. For OPC UA .NET Legacy Stack and Sample Code versions before GitHub commit 2018-03-13, update to a version after GitHub commit 2018-03-13 to resolve the issue.