CVE-2023-0217

See a problem?

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-0217

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-0217.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-0217

Aliases

Related

Published

2023-02-08T20:15:24Z

Modified

2024-09-11T06:12:34.741362Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVPPKEYpublic_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack.

The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.

References

Affected packages

Alpine:v3.15 / openssl3

Package

Name: openssl3
Purl: pkg:apk/alpine/openssl3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.8-r0

Affected versions

1.*

1.1.1-r0

1.1.1-r1

1.1.1-r2

1.1.1-r3

1.1.1-r4

1.1.1-r5

1.1.1a-r0

1.1.1a-r1

1.1.1b-r0

1.1.1b-r1

1.1.1c-r0

1.1.1c-r1

1.1.1d-r1

1.1.1d-r2

1.1.1d-r3

1.1.1d-r4

1.1.1d-r5

1.1.1e-r0

1.1.1f-r0

1.1.1g-r0

1.1.1h-r0

1.1.1i-r0

1.1.1j-r0

1.1.1k-r0

1.1.1k-r1

1.1.1l-r0

3.*

3.0.0-r0

3.0.0-r1

3.0.0-r2

3.0.0-r3

3.0.0-r4

3.0.2-r0

3.0.3-r0

3.0.5-r0

3.0.5-r1

3.0.6-r0

3.0.7-r0

Alpine:v3.16 / openssl3

Package

Name: openssl3
Purl: pkg:apk/alpine/openssl3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.8-r0

Affected versions

1.*

1.1.1-r0

1.1.1-r1

1.1.1-r2

1.1.1-r3

1.1.1-r4

1.1.1-r5

1.1.1a-r0

1.1.1a-r1

1.1.1b-r0

1.1.1b-r1

1.1.1c-r0

1.1.1c-r1

1.1.1d-r1

1.1.1d-r2

1.1.1d-r3

1.1.1d-r4

1.1.1d-r5

1.1.1e-r0

1.1.1f-r0

1.1.1g-r0

1.1.1h-r0

1.1.1i-r0

1.1.1j-r0

1.1.1k-r0

1.1.1k-r1

1.1.1l-r0

3.*

3.0.0-r0

3.0.0-r1

3.0.0-r2

3.0.0-r3

3.0.0-r4

3.0.1-r0

3.0.1-r1

3.0.2-r0

3.0.3-r0

3.0.5-r0

3.0.5-r1

3.0.6-r0

3.0.7-r0

Alpine:v3.17 / openssl

Package

Name: openssl
Purl: pkg:apk/alpine/openssl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.8-r0

Affected versions

1.*

1.1.1-r0

1.1.1-r1

1.1.1-r2

1.1.1-r3

1.1.1-r4

1.1.1-r5

1.1.1a-r0

1.1.1a-r1

1.1.1b-r0

1.1.1b-r1

1.1.1c-r0

1.1.1c-r1

1.1.1d-r1

1.1.1d-r2

1.1.1d-r3

1.1.1d-r4

1.1.1d-r5

1.1.1e-r0

1.1.1f-r0

1.1.1g-r0

1.1.1h-r0

1.1.1i-r0

1.1.1j-r0

1.1.1k-r0

1.1.1k-r1

1.1.1l-r0

3.*

3.0.0-r0

3.0.0-r1

3.0.0-r2

3.0.0-r3

3.0.0-r4

3.0.1-r0

3.0.1-r1

3.0.2-r0

3.0.3-r0

3.0.5-r0

3.0.5-r1

3.0.5-r2

3.0.5-r3

3.0.6-r0

3.0.7-r0

3.0.7-r2

Alpine:v3.18 / openssl

Package

Name: openssl
Purl: pkg:apk/alpine/openssl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.8-r0

Affected versions

1.*

1.1.1-r0

1.1.1-r1

1.1.1-r2

1.1.1-r3

1.1.1-r4

1.1.1-r5

1.1.1a-r0

1.1.1a-r1

1.1.1b-r0

1.1.1b-r1

1.1.1c-r0

1.1.1c-r1

1.1.1d-r1

1.1.1d-r2

1.1.1d-r3

1.1.1d-r4

1.1.1d-r5

1.1.1e-r0

1.1.1f-r0

1.1.1g-r0

1.1.1h-r0

1.1.1i-r0

1.1.1j-r0

1.1.1k-r0

1.1.1k-r1

1.1.1l-r0

3.*

3.0.0-r0

3.0.0-r1

3.0.0-r2

3.0.0-r3

3.0.0-r4

3.0.1-r0

3.0.1-r1

3.0.2-r0

3.0.3-r0

3.0.5-r0

3.0.5-r1

3.0.5-r2

3.0.5-r3

3.0.6-r0

3.0.7-r0

3.0.7-r1

3.0.7-r2

Alpine:v3.19 / openssl

Package

Name: openssl
Purl: pkg:apk/alpine/openssl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.8-r0

Affected versions

1.*

1.1.1-r0

1.1.1-r1

1.1.1-r2

1.1.1-r3

1.1.1-r4

1.1.1-r5

1.1.1a-r0

1.1.1a-r1

1.1.1b-r0

1.1.1b-r1

1.1.1c-r0

1.1.1c-r1

1.1.1d-r1

1.1.1d-r2

1.1.1d-r3

1.1.1d-r4

1.1.1d-r5

1.1.1e-r0

1.1.1f-r0

1.1.1g-r0

1.1.1h-r0

1.1.1i-r0

1.1.1j-r0

1.1.1k-r0

1.1.1k-r1

1.1.1l-r0

3.*

3.0.0-r0

3.0.0-r1

3.0.0-r2

3.0.0-r3

3.0.0-r4

3.0.1-r0

3.0.1-r1

3.0.2-r0

3.0.3-r0

3.0.5-r0

3.0.5-r1

3.0.5-r2

3.0.5-r3

3.0.6-r0

3.0.7-r0

3.0.7-r1

3.0.7-r2

Alpine:v3.20 / openssl

Package

Name: openssl
Purl: pkg:apk/alpine/openssl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.8-r0

Affected versions

1.*

1.1.1-r0

1.1.1-r1

1.1.1-r2

1.1.1-r3

1.1.1-r4

1.1.1-r5

1.1.1a-r0

1.1.1a-r1

1.1.1b-r0

1.1.1b-r1

1.1.1c-r0

1.1.1c-r1

1.1.1d-r1

1.1.1d-r2

1.1.1d-r3

1.1.1d-r4

1.1.1d-r5

1.1.1e-r0

1.1.1f-r0

1.1.1g-r0

1.1.1h-r0

1.1.1i-r0

1.1.1j-r0

1.1.1k-r0

1.1.1k-r1

1.1.1l-r0

3.*

3.0.0-r0

3.0.0-r1

3.0.0-r2

3.0.0-r3

3.0.0-r4

3.0.1-r0

3.0.1-r1

3.0.2-r0

3.0.3-r0

3.0.5-r0

3.0.5-r1

3.0.5-r2

3.0.5-r3

3.0.6-r0

3.0.7-r0

3.0.7-r1

3.0.7-r2

Debian:12 / openssl

Package

Name: openssl
Purl: pkg:deb/debian/openssl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.8-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / openssl

Package

Name: openssl
Purl: pkg:deb/debian/openssl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.8-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/openssl/openssl

Affected ranges

Type: GIT
Repo: https://github.com/openssl/openssl
Events: Introduced

89cd17a031e022211684eb7eb41190cf1910f9fa

Last affected

19cc035b6c6f2283573d29c7ea7f7d675cf750ce

Affected versions

openssl-3.*

openssl-3.0.0

openssl-3.0.1

openssl-3.0.2

openssl-3.0.3

openssl-3.0.4

openssl-3.0.5

openssl-3.0.6

openssl-3.0.7