Aller au contenu
en Se connecter
Non notée

CVE-2023-0286 There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName

Description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Produits et versions touchés

Produit Versions touchées Corrigé en
OpenSSL 3.0 3.0.0 → < 3.0.8 3.0.8
OpenSSL 1.1 premières → < 1.1.1t 1.1.1t
OpenSSL 1.0 premières → < 1.0.2zg 1.0.2zg
BFCClient 2.17 premières → < 2.17 2.17
RUGGEDCOM APE1808 Versions non publiées
SCALANCE W1750D (JP) 8.10 premières → < 8.10.0.9 8.10.0.9
SCALANCE W1750D (ROW) 8.10 premières → < 8.10.0.9 8.10.0.9
SCALANCE W1750D (USA) 8.10 premières → < 8.10.0.9 8.10.0.9
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
Afficher les 3 autres branches
Produit Versions touchées Corrigé en
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 1.1 premières → < 1.1 1.1
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de OpenSSL

Les 141 CVE de OpenSSL →
CVE-2026-84784 Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a… Non notée CVE-2026-84783 Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached… Non notée CVE-2026-84782 Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended… Non notée CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing… Non notée
Suivre cette CVE