{"id":"CVE-2023-0286","title":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName","summary":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\no…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-843"],"vendor":"openssl","product":"openssl","affected":["openssl >= 1.0.2, < 1.0.2zg","openssl >= 1.1.1, < 1.1.1t","openssl >= 3.0.0, < 3.0.8","stormshield_management_center < 3.3.3","stormshield_network_security >= 2.7.0, < 2.7.11","stormshield_network_security >= 2.8.0, < 3.7.34","stormshield_network_security >= 3.8.0, < 3.11.22","stormshield_network_security >= 4.0.0, < 4.3.16","stormshield_network_security >= 4.4.0, < 4.6.3"],"patched":["openssl 3.0.8","stormshield_management_center 3.3.3","stormshield_network_security 4.6.3"],"published":"2023-02-08","updated":"2026-10-14","sourceUpdated":"2026-10-14T20:17:22.450","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","references":[{"url":"https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","label":"openssl-security@openssl.org"},{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","label":"openssl-security@openssl.org"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","label":"openssl-security@openssl.org"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","label":"openssl-security@openssl.org"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","label":"openssl-security@openssl.org"},{"url":"https://security.gentoo.org/glsa/202402-08","label":"openssl-security@openssl.org"},{"url":"https://www.openssl.org/news/secadv/20230207.txt","label":"openssl-security@openssl.org"},{"url":"https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202402-08","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openssl.org/news/secadv/20230207.txt","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-028723.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-203374.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-264815.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-337522.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-455250.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-556635.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-561322.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-625862.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-769027.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-879734.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-943925.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-0286.json"},{"url":"https://access.redhat.com/security/cve/CVE-2023-0286"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164440"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0286"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286"},{"url":"https://access.redhat.com/errata/RHSA-2023:1438"},{"url":"https://access.redhat.com/errata/RHSA-2023:1335"},{"url":"https://access.redhat.com/errata/RHSA-2024:5136"},{"url":"https://access.redhat.com/errata/RHSA-2023:3354"},{"url":"https://access.redhat.com/errata/RHSA-2023:3420"},{"url":"https://access.redhat.com/errata/RHSA-2023:5209"},{"url":"https://access.redhat.com/errata/RHSA-2024:6095"},{"url":"https://access.redhat.com/errata/RHSA-2025:7895"},{"url":"https://access.redhat.com/errata/RHSA-2023:4124"},{"url":"https://access.redhat.com/errata/RHSA-2023:4252"},{"url":"https://access.redhat.com/errata/RHSA-2023:4128"},{"url":"https://access.redhat.com/errata/RHSA-2023:2932"},{"url":"https://access.redhat.com/errata/RHSA-2023:2022"},{"url":"https://access.redhat.com/errata/RHSA-2023:1199"},{"url":"https://access.redhat.com/errata/RHSA-2023:0946"},{"url":"https://access.redhat.com/errata/RHSA-2023:2165"},{"url":"https://access.redhat.com/errata/RHSA-2025:7733"},{"url":"https://access.redhat.com/errata/RHSA-2025:7937"},{"url":"https://access.redhat.com/errata/RHSA-2023:1437"},{"url":"https://access.redhat.com/errata/RHSA-2023:1439"},{"url":"https://access.redhat.com/errata/RHSA-2023:1440"},{"url":"https://access.redhat.com/errata/RHSA-2023:1441"},{"url":"https://access.redhat.com/errata/RHSA-2023:1405"},{"url":"https://access.redhat.com/errata/RHSA-2023:3421"},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-x4qr-2fvf-3mr5"},{"url":"https://github.com/pyca/cryptography"},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0006.html"}],"tags":["nvd","csaf","vex","red-hat","osv","pip","cve.org"],"epss":0.69286,"epssPercentile":0.99355,"aliases":["GHSA-x4qr-2fvf-3mr5","PYSEC-2026-800","RUSTSEC-2023-0006"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:54.108Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-03-06T15:57:22.031399Z"},"slug":"CVE-2023-0286","body":"## Overview\n\nThere is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network.\n\n## Affected\n\n- `openssl >= 1.0.2, < 1.0.2zg`\n- `openssl >= 1.1.1, < 1.1.1t`\n- `openssl >= 3.0.0, < 3.0.8`\n- `stormshield_management_center < 3.3.3`\n- `stormshield_network_security >= 2.7.0, < 2.7.11`\n- `stormshield_network_security >= 2.8.0, < 3.7.34`\n- `stormshield_network_security >= 3.8.0, < 3.11.22`\n- `stormshield_network_security >= 4.0.0, < 4.3.16`\n- `stormshield_network_security >= 4.4.0, < 4.6.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssl 3.0.8`\n- `stormshield_management_center 3.3.3`\n- `stormshield_network_security 4.6.3`\n\n## Package advisory (CVE-2023-0286)\n\nAffected packages:\n\n- `cryptography >= 0.8.1, < 39.0.1`\n- `openssl-src < 111.25.0`\n- `openssl-src >= 300.0.0, < 300.0.12`\n\nPatched in:\n\n- `cryptography 39.0.1`\n- `openssl-src 111.25.0`\n- `openssl-src 300.0.12`\n\nSource: https://osv.dev/vulnerability/GHSA-x4qr-2fvf-3mr5\n\n## Vendor advisories\n\n- **RHSA-2023:1438** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 6 ELS), Red Hat Enterprise Linux Server Optional (v. 6 ELS) · released 2023-03-23 · [advisory](https://access.redhat.com/errata/RHSA-2023:1438)\n- **RHSA-2023:1335** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), Red Hat Enterprise Linux Workstation (v. 7), … · released 2023-03-20 · [advisory](https://access.redhat.com/errata/RHSA-2023:1335)\n- **RHSA-2024:5136** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.7), Red Hat Enterprise Linux Server Optional AUS (v. 7.7) · released 2024-08-08 · [advisory](https://access.redhat.com/errata/RHSA-2024:5136)\n- **RHSA-2023:3354** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8 · released 2023-06-05 · [advisory](https://access.redhat.com/errata/RHSA-2023:3354)\n- **RHSA-2023:3420** · Red Hat · fixed in: Red Hat JBoss Web Server 5.7 for RHEL 7 Server, Red Hat JBoss Web Server 5.7 for RHEL 8, Red Hat JBoss Web Server 5.7 for RHEL 9 · released 2023-06-05 · [advisory](https://access.redhat.com/errata/RHSA-2023:3420)\n- **RHSA-2023:5209** · Red Hat · fixed in: Red Hat Virtualization 4 Hypervisor for RHEL 8 · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5209)\n- **RHSA-2024:6095** · Red Hat · fixed in: RHOL 5.9 for RHEL 9 · released 2024-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2024:6095)\n- **RHSA-2025:7895** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2025-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2025:7895)\n- **RHSA-2023:4124** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2), Red Hat Enterprise Linux AppStream E4S (v. 8.2), Red Hat Enterprise Linux AppStream TUS (v. 8.2) · released 2023-07-18 · [advisory](https://access.redhat.com/errata/RHSA-2023:4124)\n- **RHSA-2023:4252** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.4), Red Hat Enterprise Linux AppStream TUS (v.8.4) · released 2023-07-25 · [advisory](https://access.redhat.com/errata/RHSA-2023:4252)\n- **RHSA-2023:4128** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.8.6) · released 2023-07-18 · [advisory](https://access.redhat.com/errata/RHSA-2023:4128)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 7, Red Hat JBoss Web Server 3 · no fix planned: Red Hat JBoss Web Server 3, Red Hat Enterprise Linux 7 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-0286.json)","depth":"twilight","depthScore":55,"depthScoreParts":{"impact":40.7,"likelihood":13.9,"exploitation":0,"ransomware":0},"changes":[{"seq":223076,"id":"CVE-2023-0286","ts":1792168912815,"field":"epss","old":"0.61979","new":"0.71239"}]}