PT-2023-25312 · Libressl+2 · Libressl+2

CVE-2023-35784 · Published 2023-05-29 · Updated 2023-11-06

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenBSD versions 7.2 before errata 026 OpenBSD versions 7.3 before errata 004 LibreSSL versions prior to 3.6.3 LibreSSL versions 3.7.x prior to 3.7.3

Description A double free or use after free could occur after SSL clear. This issue does not affect OpenSSL.

Recommendations For OpenBSD version 7.2, apply errata 026 to resolve the issue. For OpenBSD version 7.3, apply errata 004 to resolve the issue. For LibreSSL version prior to 3.6.3, update to version 3.6.3 or later to resolve the issue. For LibreSSL version 3.7.x prior to 3.7.3, update to version 3.7.3 or later to resolve the issue.

Exploit

Fix

Use After Free

Double Free

Weakness Enumeration

CWE-416

CWE-415

Related Identifiers

ALT-PU-2023-1902

ALT-PU-2023-4398

ALT-PU-2023-5593

CVE-2023-35784

Affected Products

Alt Linux

Libressl

Openbsd

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35784.json · Exploit
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig · Patch
• https://osv.dev/vulnerability/BELL-CVE-2023-35784 · Vendor Advisory
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-35784 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35784 · Vendor Advisory
• https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54 · Note
• https://t.me/cvenotify/52538 · Telegram Post
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt · Note
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt · Note
• https://docs.bell-sw.com/security/cves/CVE-2023-35784 · Note