PT-2023-31719 · Crypto+++2 · Crypto+++2

Roadicing · Published 2023-12-18 · Updated 2024-06-15 · CVE-2023-50981

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Crypto++ (cryptopp) versions prior to 8.9.0

Description The issue allows attackers to cause a denial of service, specifically an infinite loop, through crafted DER public-key data associated with squared odd numbers. This can be achieved with numbers such as the square of 268995137513890432434389773128616504853.

Recommendations For versions prior to 8.9.0, update to version 8.9.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ModularSquareRoot function in Crypto++ until a patch is applied. Avoid processing DER public-key data from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2023-50981

OPENSUSE-SU-2024:13550-1

OPENSUSE-SU-2024_0157-1

SUSE-SU-2024:0157-1

SUSE-SU-2024_0157-1

Affected Products

Crypto++

Debian

Suse

References · 13

• 🔥 https://github.com/weidai11/cryptopp/issues/1249 · Exploit
• https://ubuntu.com/security/CVE-2023-50981 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0157-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-50981 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13550-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50981 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-50981 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-50981 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-50981 · Vendor Advisory
• https://suse.com/security/cve/CVE-2023-50981 · Note
• https://suse.com/support/update/announcement/2024/suse-su-20240157-1 · Note
• https://bugzilla.suse.com/1218222 · Note