CVE-2010-1633: Medium severity OpenSSL OpenSSL vulnerability
From the upstream advisory [1]:
Invalid Return value check in pkeyrsaverifyrecover ====================================================
When verification recovery fails for RSA keys an uninitialised buffer with an undefined length is returned instead of an error code (CVE-2010-1633).
This bug is only present in OpenSSL 1.0.0 and only affects applications that call the function EVPPKEYverifyrecover(). As this function is not present in previous versions of OpenSSL and not used by OpenSSL internal code very few applications should be affected. The OpenSSL utility application "pkeyutl" does use this function.
Affected users should update to 1.0.0a which contains a patch to correct this bug.
Thanks to Peter-Michael Hager for reporting this issue.
[1] http://www.openssl.org/news/secadv20100601.txt
Other sources
RSA verification recovery in the EVPPKEYverifyrecover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive information via unspecified vectors. NOTE: some of these details are obtained from third party information.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1633?
CVE-2010-1633 is classified as a moderate severity vulnerability affecting OpenSSL versions 1.0.0 and its betas.
How do I fix CVE-2010-1633?
To fix CVE-2010-1633, upgrade to a patched version of OpenSSL, specifically version 1.0.1 or later.
What can happen if I don't mitigate CVE-2010-1633?
Failing to mitigate CVE-2010-1633 could lead to unauthorized access or exploitation through the use of RSA keys.
What is the nature of the flaw in CVE-2010-1633?
CVE-2010-1633 involves an invalid return value check in the pkey_rsa_verifyrecover function that returns an uninitialized buffer.
Which OpenSSL versions are affected by CVE-2010-1633?
CVE-2010-1633 affects OpenSSL version 1.0.0 and all beta versions leading up to it.