PT-2023-25312 · Openbsd+2 · Openbsd+2

Published 2023-05-29 · Updated 2023-11-06 · CVE-2023-35784

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenBSD versions 7.2 before errata 026 OpenBSD versions 7.3 before errata 004 LibreSSL versions prior to 3.6.3 LibreSSL versions 3.7.x prior to 3.7.3

Description A double free or use after free could occur after SSL clear. This issue does not affect OpenSSL.

Recommendations For OpenBSD version 7.2, apply errata 026 to resolve the issue. For OpenBSD version 7.3, apply errata 004 to resolve the issue. For LibreSSL version prior to 3.6.3, update to version 3.6.3 or later to resolve the issue. For LibreSSL version 3.7.x prior to 3.7.3, update to version 3.7.3 or later to resolve the issue.

Fix

Double Free

Use After Free

Weakness Enumeration

CWE-415

CWE-416

Related Identifiers

ALT-PU-2023-1902

ALT-PU-2023-4398

ALT-PU-2023-5593

CVE-2023-35784

Affected Products

Alt Linux

Libressl

Openbsd

References · 10

• https://osv.dev/vulnerability/CVE-2023-35784 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-35784 · Vendor Advisory
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-35784 · Security Note
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig · Patch
• https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54 · Note
• https://docs.bell-sw.com/security/cves/CVE-2023-35784 · Note
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt · Note
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt · Note
• https://t.me/cvenotify/52538 · Telegram Post