Citrix has identified an isolated issue in which some customers experienced a crash condition after upgrading to the current build with HTTP/2 enabled.
What Product is Affected?
NetScaler appliance upgraded to version NS13.1 Build 45.63 or NS13.0 Build 90.11
*No other versions are impacted by this HTTP/2 issue.
Is there a workaround or fix?
Workaround: Disable http2 in the HTTP profile bound to the virtual server.
Fix: Engineering is working on a code fix and will update the ETA of the next build as soon as possible.
How to verify if http2 is enabled?
Run the following command from the CLI and verify if http2Direct Is reported as enabled.
> show run | grep http2
Example of output if enabled:
> set ns httpProfile <name of httpprofile> -http2 ENABLED -http2Direct ENABLED
Example of output if not enabled:
> set ns httpProfile <name of httpprofile> -http2 DISABLED -http2Direct DISABLED
How to disable http2 if enabled?
> set ns httpProfile <name of the httpprofile> -http2 DISABLED -http2Direct DISABLED
Citrix published on May, 9th a new Security Bulletin for NetScaler ADC and Netscaler Gateway. The severity is rated as medium. AXACOM is recommending to upgrade the NetScaler ADCs and Gateways in the next few days according to the Citrix CTX477714.
Please monitor as well the Citrix CTX article under the following link:
Vulnerabilities have been discovered in Citrix ADC and Citrix Gateway listed below, that, if exploited, could result in the following security issues:
Impacted Products, Versions and Components
The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability:
Citrix ADC and Citrix Gateway 13.1 before 13.1-45.61
Citrix ADC and Citrix Gateway 13.0 before 13.0-90.11
Citrix ADC and Citrix Gateway 12.1 before 12.1-65.35
Citrix ADC 12.1-FIPS before 12.1-55.296
Citrix ADC 12.1-NDcPP before 12.1-55.296
This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action.
CVE ID
Description
Pre-requisites
CWE
CVSS
CVE-2023-24488
Cross site scripting
Appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Affected customers of Citrix ADC and Citrix Gateway are recommended to install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible:
Citrix ADC and Citrix Gateway 13.1-45.61 and later releases
Citrix ADC and Citrix Gateway 13.0-90.11 and later releases of 13.0
Citrix ADC and Citrix Gateway 12.1-65.35 and later releases of 12.1
Citrix ADC 12.1-FIPS 12.1-55.296 and later releases of 12.1-FIPS
Citrix ADC 13.1-FIPS 13.1-37.150 and later releases of 13.1-FIPS
Citrix ADC 12.1-NDcPP 12.1-55.296 and later releases of 12.1-NDcPP
Vulnerabilities have been discovered in Citrix Gateway and Citrix ADC, listed below. Note that only appliances that are operating as a Gateway (appliances using the SSL VPN functionality or deployed as an ICA proxy with authentication enabled) are affected by the first issue, which is rated as a Critical severity vulnerability.
CVE-ID
Description
CWE
Affected Products
Pre-conditions
CVE-2022-27510
Unauthorized access to Gateway user capabilities
CWE-288: Authentication Bypass Using an Alternate Path or Channel
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway)
CVE-2022-27513
Remote desktop takeover via phishing
CWE-345: Insufficient Verification of Data Authenticity
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway) and the RDP proxy functionality must be configured
CVE-2022-27516
User login brute force protection functionality bypass
CWE-693: Protection Mechanism Failure
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway) OR AAA virtual server and the user lockout functionality “Max Login Attempts” must be configured
The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability:
Citrix ADC and Citrix Gateway 13.1 before 13.1-33.47
Citrix ADC and Citrix Gateway 13.0 before 13.0-88.12
Citrix ADC and Citrix Gateway 12.1 before 12.1.65.21
Citrix ADC 12.1-FIPS before 12.1-55.289
Citrix ADC 12.1-NDcPP before 12.1-55.289
This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway appliances. Customers using Citrix-managed cloud services do not need to take any action.
A vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows). If exploited, this issue would allow an adversary, who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM. This issue has the following identifier:
CVE-ID
Description
CWE
Pre-conditions
CVE-2022-21827
Arbitrary corruption or deletion of files as SYSTEM
CWE-284: Improper Access Control
Local access to a machine that has the vulnerable plug-in installed
The following supported versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) are affected by this vulnerability:
Citrix Gateway Plug-in for Windows versions before 21.9.1.2
What Customers Should Do
This issue has been addressed in the following versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows):
Citrix Gateway Plug-in for Windows version 21.9.1.2 and later releases
Nach Update des Chrome oder chromium basierende Browser auf die Version 100.0.4896.60 bekommen User nach der Anmeldung am Citrix Gateway ein «spinning circle» und nicht die published Apps angezeigt. Das Problem tritt aufgrund einer Inkompatibilität mit den Citrix ADC Custom Themes auf.
Betroffen ist die Citrix ADC/Gateway Version 13.0 83.29
Systeme mit Citrix ADC/Gateway Version 13.1 12.50 und höher sind nicht betroffen. Ebenfalls nicht betroffen sind Firefox, Apple Safari Browser und ältere Chrome/Chromium Browser.
