--- id: CVE-2023-0286 title: |- There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName summary: >- There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type o… severity: high cvss: 7.4 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H' cwe: - CWE-843 vendor: openssl product: openssl affected: - 'openssl >= 1.0.2, < 1.0.2zg' - 'openssl >= 1.1.1, < 1.1.1t' - 'openssl >= 3.0.0, < 3.0.8' - stormshield_management_center < 3.3.3 - 'stormshield_network_security >= 2.7.0, < 2.7.11' - 'stormshield_network_security >= 2.8.0, < 3.7.34' - 'stormshield_network_security >= 3.8.0, < 3.11.22' - 'stormshield_network_security >= 4.0.0, < 4.3.16' - 'stormshield_network_security >= 4.4.0, < 4.6.3' patched: - openssl 3.0.8 - stormshield_management_center 3.3.3 - stormshield_network_security 4.6.3 published: '2023-02-08' updated: '2026-10-14' sourceUpdated: '2026-10-14T20:17:22.450' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-0286' references: - url: 'https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt' label: openssl-security@openssl.org - url: 'https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig' label: openssl-security@openssl.org - url: >- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 label: openssl-security@openssl.org - url: >- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658 label: openssl-security@openssl.org - url: >- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d label: openssl-security@openssl.org - url: 'https://security.gentoo.org/glsa/202402-08' label: openssl-security@openssl.org - url: 'https://www.openssl.org/news/secadv/20230207.txt' label: openssl-security@openssl.org - url: 'https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202402-08' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.openssl.org/news/secadv/20230207.txt' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-028723.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-203374.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-264815.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-337522.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-455250.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-556635.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-561322.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-625862.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-769027.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-879734.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-943925.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-0286.json - url: 'https://access.redhat.com/security/cve/CVE-2023-0286' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2164440' - url: 'https://www.cve.org/CVERecord?id=CVE-2023-0286' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-0286' - url: 'https://access.redhat.com/errata/RHSA-2023:1438' - url: 'https://access.redhat.com/errata/RHSA-2023:1335' - url: 'https://access.redhat.com/errata/RHSA-2024:5136' - url: 'https://access.redhat.com/errata/RHSA-2023:3354' - url: 'https://access.redhat.com/errata/RHSA-2023:3420' - url: 'https://access.redhat.com/errata/RHSA-2023:5209' - url: 'https://access.redhat.com/errata/RHSA-2024:6095' - url: 'https://access.redhat.com/errata/RHSA-2025:7895' - url: 'https://access.redhat.com/errata/RHSA-2023:4124' - url: 'https://access.redhat.com/errata/RHSA-2023:4252' - url: 'https://access.redhat.com/errata/RHSA-2023:4128' - url: 'https://access.redhat.com/errata/RHSA-2023:2932' - url: 'https://access.redhat.com/errata/RHSA-2023:2022' - url: 'https://access.redhat.com/errata/RHSA-2023:1199' - url: 'https://access.redhat.com/errata/RHSA-2023:0946' - url: 'https://access.redhat.com/errata/RHSA-2023:2165' - url: 'https://access.redhat.com/errata/RHSA-2025:7733' - url: 'https://access.redhat.com/errata/RHSA-2025:7937' - url: 'https://access.redhat.com/errata/RHSA-2023:1437' - url: 'https://access.redhat.com/errata/RHSA-2023:1439' - url: 'https://access.redhat.com/errata/RHSA-2023:1440' - url: 'https://access.redhat.com/errata/RHSA-2023:1441' - url: 'https://access.redhat.com/errata/RHSA-2023:1405' - url: 'https://access.redhat.com/errata/RHSA-2023:3421' - url: >- https://github.com/pyca/cryptography/security/advisories/GHSA-x4qr-2fvf-3mr5 - url: 'https://github.com/pyca/cryptography' - url: 'https://rustsec.org/advisories/RUSTSEC-2023-0006.html' tags: - nvd - csaf - vex - red-hat - osv - pip - cve.org epss: 0.69286 epssPercentile: 0.99355 aliases: - GHSA-x4qr-2fvf-3mr5 - PYSEC-2026-800 - RUSTSEC-2023-0006 ecosystem: pip ingestedAt: '2026-07-08T18:25:54.108Z' ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2025-03-06T15:57:22.031399Z' --- ## Overview There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. ## Affected - `openssl >= 1.0.2, < 1.0.2zg` - `openssl >= 1.1.1, < 1.1.1t` - `openssl >= 3.0.0, < 3.0.8` - `stormshield_management_center < 3.3.3` - `stormshield_network_security >= 2.7.0, < 2.7.11` - `stormshield_network_security >= 2.8.0, < 3.7.34` - `stormshield_network_security >= 3.8.0, < 3.11.22` - `stormshield_network_security >= 4.0.0, < 4.3.16` - `stormshield_network_security >= 4.4.0, < 4.6.3` ## Remediation Upgrade past the affected range: - `openssl 3.0.8` - `stormshield_management_center 3.3.3` - `stormshield_network_security 4.6.3` ## Package advisory (CVE-2023-0286) Affected packages: - `cryptography >= 0.8.1, < 39.0.1` - `openssl-src < 111.25.0` - `openssl-src >= 300.0.0, < 300.0.12` Patched in: - `cryptography 39.0.1` - `openssl-src 111.25.0` - `openssl-src 300.0.12` Source: https://osv.dev/vulnerability/GHSA-x4qr-2fvf-3mr5 ## Vendor advisories - **RHSA-2023:1438** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 6 ELS), Red Hat Enterprise Linux Server Optional (v. 6 ELS) · released 2023-03-23 · [advisory](https://access.redhat.com/errata/RHSA-2023:1438) - **RHSA-2023:1335** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), Red Hat Enterprise Linux Workstation (v. 7), … · released 2023-03-20 · [advisory](https://access.redhat.com/errata/RHSA-2023:1335) - **RHSA-2024:5136** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.7), Red Hat Enterprise Linux Server Optional AUS (v. 7.7) · released 2024-08-08 · [advisory](https://access.redhat.com/errata/RHSA-2024:5136) - **RHSA-2023:3354** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8 · released 2023-06-05 · [advisory](https://access.redhat.com/errata/RHSA-2023:3354) - **RHSA-2023:3420** · Red Hat · fixed in: Red Hat JBoss Web Server 5.7 for RHEL 7 Server, Red Hat JBoss Web Server 5.7 for RHEL 8, Red Hat JBoss Web Server 5.7 for RHEL 9 · released 2023-06-05 · [advisory](https://access.redhat.com/errata/RHSA-2023:3420) - **RHSA-2023:5209** · Red Hat · fixed in: Red Hat Virtualization 4 Hypervisor for RHEL 8 · released 2023-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2023:5209) - **RHSA-2024:6095** · Red Hat · fixed in: RHOL 5.9 for RHEL 9 · released 2024-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2024:6095) - **RHSA-2025:7895** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2025-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2025:7895) - **RHSA-2023:4124** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2), Red Hat Enterprise Linux AppStream E4S (v. 8.2), Red Hat Enterprise Linux AppStream TUS (v. 8.2) · released 2023-07-18 · [advisory](https://access.redhat.com/errata/RHSA-2023:4124) - **RHSA-2023:4252** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.4), Red Hat Enterprise Linux AppStream TUS (v.8.4) · released 2023-07-25 · [advisory](https://access.redhat.com/errata/RHSA-2023:4252) - **RHSA-2023:4128** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.8.6) · released 2023-07-18 · [advisory](https://access.redhat.com/errata/RHSA-2023:4128) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 7, Red Hat JBoss Web Server 3 · no fix planned: Red Hat JBoss Web Server 3, Red Hat Enterprise Linux 7 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-0286.json)