PT-2022-6545 · Openssl+7 · Openssl+7

Marc Schã¶Nefeld + 2 · Published 2022-12-27 · Updated 2024-06-15 · CVE-2023-0216

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i PKCS7(), d2i PKCS7 bio(), or d2i PKCS7 fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function; however, third-party applications might call these functions on untrusted data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2023:0946

BDU:2023-02239

CVE-2023-0216

GHSA-29XX-HCV2-C4CP

MGASA-2023-0130

OPENSUSE-SU-2023_0312-1

OPENSUSE-SU-2024:12716-1

RHSA-2023:0946

RHSA-2023:1199

RHSA-2023_0946

RLSA-2023:0946

RUSTSEC-2023-0011

SUSE-SU-2023:0312-1

USN-5844-1

Affected Products

Almalinux

Ibm Aix

Linuxmint

Openssl

Red Hat

Rocky Linux

Suse

Ubuntu

References · 106

• https://cve.org/CVERecord?id=CVE-2023-0216 · Security Note
• https://errata.rockylinux.org/RLSA-2023:0946 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-0216 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MGJS3DWIQT3W4V6WXNE2IHFLOKIFL22G · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0286 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-0216 · Vendor Advisory
• https://openssl.org/news/secadv/20230207.txt · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2023-0216 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0216 · Security Note
• https://osv.dev/vulnerability/GHSA-29xx-hcv2-c4cp · Vendor Advisory
• https://debian.org/security/2023/dsa-5343 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0215 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0401 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-4304 · Vendor Advisory