PT-2024-1576 · Openssl+9 · Openssl+9
Oss-Fuzz
+1
·
Published
2024-01-15
·
Updated
2026-04-27
·
CVE-2023-6237
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 3.0 through 3.1
Description
The issue is related to the function
EVP PKEY public check() in the OpenSSL library, which can lead to a Denial of Service (DoS) attack when checking excessively long invalid RSA public keys. This can cause long delays in applications that use this function to check RSA public keys obtained from untrusted sources. The EVP PKEY public check() function is called from the OpenSSL pkey command line application, making it vulnerable when used with the '-pubin' and '-check' options on untrusted data. The OpenSSL SSL/TLS implementation is not affected by this issue.Recommendations
For OpenSSL versions 3.0 through 3.1, consider disabling the
EVP PKEY public check() function until a patch is available to prevent potential Denial of Service attacks. Restrict access to the OpenSSL pkey command line application when used with the '-pubin' and '-check' options on untrusted data to minimize the risk of exploitation. Avoid using the EVP PKEY public check() function on untrusted RSA public keys until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Ibm Aix
Linuxmint
Openssl
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu