CVE-2023-0286High· 7.4▾ TwilightThere is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type o…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 13.9 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
60%
Last analysed / modified upstream
60% → 71%
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.
When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
openssl >= 1.0.2, < 1.0.2zgopenssl >= 1.1.1, < 1.1.1topenssl >= 3.0.0, < 3.0.8stormshield_management_center < 3.3.3stormshield_network_security >= 2.7.0, < 2.7.11stormshield_network_security >= 2.8.0, < 3.7.34stormshield_network_security >= 3.8.0, < 3.11.22stormshield_network_security >= 4.0.0, < 4.3.16stormshield_network_security >= 4.4.0, < 4.6.3Upgrade past the affected range:
openssl 3.0.8stormshield_management_center 3.3.3stormshield_network_security 4.6.3Affected packages:
cryptography >= 0.8.1, < 39.0.1openssl-src < 111.25.0openssl-src >= 300.0.0, < 300.0.12Patched in:
cryptography 39.0.1openssl-src 111.25.0openssl-src 300.0.12Source: https://osv.dev/vulnerability/GHSA-x4qr-2fvf-3mr5
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-5678Medium· 5.3Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may ex…
CVE-2023-3817Medium· 5.3Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience l…
CVE-2023-3446Medium· 5.3Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience l…
CVE-2023-2650Medium· 6.5Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CM…
CVE-2023-0466Medium· 5.3The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification
CVE-2023-0465Medium· 5.3Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL an…