PT-2024-4000 · Openssl+8 · Openssl+8
Oss-Fuzz
+2
·
Published
2024-05-16
·
Updated
2026-04-27
·
CVE-2024-4603
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 3.0 and 3.1 FIPS providers
Description
The issue is related to the functions
EVP PKEY param check() and EVP PKEY public check() in the OpenSSL library, which can lead to a Denial of Service (DoS) attack when checking excessively long DSA keys or parameters. These functions perform various checks on DSA parameters, and some computations can take a long time if the modulus (p parameter) is too large. An application that calls these functions and supplies a key or parameters obtained from an untrusted source could be vulnerable to a DoS attack. The OpenSSL SSL/TLS implementation is not affected by this issue.Recommendations
For OpenSSL versions 3.0 and 3.1 FIPS providers, consider disabling the
EVP PKEY param check() and EVP PKEY public check() functions until a patch is available. Restrict access to the pkey and pkeyparam command line applications when using the -check option to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Ibm Aix
Linuxmint
Openssl
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu