Skip to content
fr Sign in
Not rated

CVE-2023-0286 There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName

Description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Affected products and versions

Product Affected versions Fixed in
OpenSSL 3.0 3.0.0 → < 3.0.8 3.0.8
OpenSSL 1.1 earliest → < 1.1.1t 1.1.1t
OpenSSL 1.0 earliest → < 1.0.2zg 1.0.2zg
BFCClient 2.17 earliest → < 2.17 2.17
RUGGEDCOM APE1808 Versions not published
SCALANCE W1750D (JP) 8.10 earliest → < 8.10.0.9 8.10.0.9
SCALANCE W1750D (ROW) 8.10 earliest → < 8.10.0.9 8.10.0.9
SCALANCE W1750D (USA) 8.10 earliest → < 8.10.0.9 8.10.0.9
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
Show the 3 other branches
Product Affected versions Fixed in
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 1.1 earliest → < 1.1 1.1
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5

References

Timeline

  1. Published
  2. Last modified

Other CVEs of OpenSSL

The 141 CVEs of OpenSSL →
CVE-2026-84784 Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a… Not rated CVE-2026-84783 Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached… Not rated CVE-2026-84782 Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended… Not rated CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing… Not rated
Track this CVE