Kurt Roeckx

**Name of the Vulnerable Software and Affected Versions** OpenSSL (affected versions not specified) **Description** An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the `EVP PKEY public check()` function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSSL (affected versions not specified) **Description** The function PEM read bio ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the `name out`, `header` and `data` arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM read bio ex() will return a failure code but will populate the `header` argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM read bio() and PEM read() are simple wrappers around PEM read bio ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM X509 INFO read bio ex() and SSL CTX use serverinfo file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the `header` argument if PEM read bio ex() returns a failure code. These locations include the PEM read bio TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GnuTLS versions prior to 3.3.17 GnuTLS versions 3.4.x prior to 3.4.4 **Description** The issue is related to a double free vulnerability that can be exploited by remote attackers to cause a denial of service. This can be achieved by providing a long DistinguishedName (DN) entry in a certificate. The vulnerability is associated with an error in memory management, specifically a double free error, which can lead to a denial of service. **Recommendations** For GnuTLS versions prior to 3.3.17, update to version 3.3.17 or later. For GnuTLS versions 3.4.x prior to 3.4.4, update to version 3.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** Ruby versions 1.8 and 1.9 **Description** The issue is related to the improper checking of the return value from the OCSP basic verify function in the ext/openssl/ossl ocsp.c file. This could allow remote attackers to present an invalid X.509 certificate, possibly involving a revoked certificate. **Recommendations** For Ruby version 1.8, update to a version that properly checks the return value from the OCSP basic verify function. For Ruby version 1.9, update to a version that properly checks the return value from the OCSP basic verify function.