PT-2023-25312 · Libressl+2 · Libressl+2

CVE-2023-35784 · Publicado 2023-05-29 · Atualizado 2023-11-06

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenBSD versions 7.2 before errata 026 OpenBSD versions 7.3 before errata 004 LibreSSL versions prior to 3.6.3 LibreSSL versions 3.7.x prior to 3.7.3

Description A double free or use after free could occur after SSL clear. This issue does not affect OpenSSL.

Recommendations For OpenBSD version 7.2, apply errata 026 to resolve the issue. For OpenBSD version 7.3, apply errata 004 to resolve the issue. For LibreSSL version prior to 3.6.3, update to version 3.6.3 or later to resolve the issue. For LibreSSL version 3.7.x prior to 3.7.3, update to version 3.7.3 or later to resolve the issue.

Exploit

Correção

Use After Free

Double Free

Enumeração de Fraquezas

CWE-416

CWE-415

Identificadores relacionados

ALT-PU-2023-1902

ALT-PU-2023-4398

ALT-PU-2023-5593

CVE-2023-35784

Produtos afetados

Alt Linux

Libressl

Openbsd

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35784.json · Exploit
• https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54 · Nota
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig · Correção
• https://t.me/cvenotify/52538 · Publicação no Telegram
• https://osv.dev/vulnerability/BELL-CVE-2023-35784 · Aviso do Fabricante
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt · Nota
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt · Nota
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-35784 · Nota de Segurança
• https://docs.bell-sw.com/security/cves/CVE-2023-35784 · Nota
• https://osv.dev/vulnerability/CVE-2023-35784 · Aviso do Fabricante