CVE-2023-0286: X.400 address type confusion in X.509 GeneralName
First published: Wed Jan 25 2023(Updated: )
A type confusion vulnerability was found in OpenSSL when OpenSSL X.400 addresses processing inside an X.509 GeneralName. When CRL checking is enabled (for example, the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or cause a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, of which neither needs a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. In this case, this vulnerability is likely only to affect applications that have implemented their own functionality for retrieving CRLs over a network.
Credit: openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jbcs-httpd24-openssl | <1:1.1.1k-14.el8 | 1:1.1.1k-14.el8 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1k-14.el7 | 1:1.1.1k-14.el7 |
| redhat/openssl | <0:1.0.1e-61.el6_10 | 0:1.0.1e-61.el6_10 |
| redhat/openssl | <1:1.0.2k-26.el7_9 | 1:1.0.2k-26.el7_9 |
| redhat/edk2 | <0:20220126gitbb1bba3d77-4.el8 | 0:20220126gitbb1bba3d77-4.el8 |
| redhat/openssl | <1:1.1.1k-9.el8_7 | 1:1.1.1k-9.el8_7 |
| redhat/openssl | <1:1.1.1c-6.el8_1 | 1:1.1.1c-6.el8_1 |
| redhat/edk2 | <0:20190829git37eef91017ad-9.el8_2.2 | 0:20190829git37eef91017ad-9.el8_2.2 |
| redhat/openssl | <1:1.1.1c-21.el8_2 | 1:1.1.1c-21.el8_2 |
| redhat/edk2 | <0:20200602gitca407c7246bf-4.el8_4.3 | 0:20200602gitca407c7246bf-4.el8_4.3 |
| redhat/openssl | <1:1.1.1g-18.el8_4 | 1:1.1.1g-18.el8_4 |
| redhat/edk2 | <0:20220126gitbb1bba3d77-2.el8_6.1 | 0:20220126gitbb1bba3d77-2.el8_6.1 |
| redhat/openssl | <1:1.1.1k-8.el8_6 | 1:1.1.1k-8.el8_6 |
| redhat/openssl | <1:3.0.1-47.el9_1 | 1:3.0.1-47.el9_1 |
| redhat/edk2 | <0:20221207gitfff6d81270b5-9.el9_2 | 0:20221207gitfff6d81270b5-9.el9_2 |
| redhat/openssl | <1:3.0.1-46.el9_0 | 1:3.0.1-46.el9_0 |
| redhat/edk2 | <0:20220126gitbb1bba3d77-3.el9_0.2 | 0:20220126gitbb1bba3d77-3.el9_0.2 |
| redhat/jws5-tomcat-native | <0:1.2.31-14.redhat_14.el7 | 0:1.2.31-14.redhat_14.el7 |
| redhat/jws5-tomcat-native | <0:1.2.31-14.redhat_14.el8 | 0:1.2.31-14.redhat_14.el8 |
| redhat/jws5-tomcat-native | <0:1.2.31-14.redhat_14.el9 | 0:1.2.31-14.redhat_14.el9 |
| OpenSSL OpenSSL | >=1.0.2<1.0.2zg | |
| OpenSSL OpenSSL | >=1.1.1<1.1.1t | |
| OpenSSL OpenSSL | >=3.0.0<3.0.8 | |
| Stormshield Stormshield Management Center | <3.3.3 | |
| Stormshield Stormshield Network Security | >=2.7.0<2.7.11 | |
| Stormshield Stormshield Network Security | >=2.8.0<3.7.34 | |
| Stormshield Stormshield Network Security | >=3.8.0<3.11.22 | |
| Stormshield Stormshield Network Security | >=4.0.0<4.3.16 | |
| Stormshield Stormshield Network Security | >=4.4.0<4.6.3 | |
| IBM Watson Knowledge Catalog on-prem | <=4.x | |
| rust/openssl-src | >=300.0.0<300.0.12 | 300.0.12 |
| rust/openssl-src | <111.25.0 | 111.25.0 |
| pip/cryptography | >=0.8.1<39.0.1 | 39.0.1 |
| ubuntu/nodejs | <12.22.9~dfsg-1ubuntu3.3 | 12.22.9~dfsg-1ubuntu3.3 |
| ubuntu/openssl | <1.1.1-1ubuntu2.1~18.04.21 | 1.1.1-1ubuntu2.1~18.04.21 |
| ubuntu/openssl | <1.1.1 | 1.1.1 |
| ubuntu/openssl | <3.0.2-0ubuntu1.8 | 3.0.2-0ubuntu1.8 |
| ubuntu/openssl | <3.0.5-2ubuntu2.1 | 3.0.5-2ubuntu2.1 |
| ubuntu/openssl | <3.0.8-1ubuntu1 | 3.0.8-1ubuntu1 |
| ubuntu/openssl | <3.0.8-1ubuntu1 | 3.0.8-1ubuntu1 |
| ubuntu/openssl | <1.0.1 | 1.0.1 |
| ubuntu/openssl | <3.0.8<1.1.1 | 3.0.8 1.1.1 |
| ubuntu/openssl | <1.0.2 | 1.0.2 |
| ubuntu/openssl1.0 | <1.0.2 | 1.0.2 |
| debian/openssl | <=1.1.1n-0+deb10u3 | 1.1.1n-0+deb10u6 1.1.1w-0+deb11u1 1.1.1n-0+deb11u5 3.0.11-1~deb12u2 3.2.1-3 |
Remedy
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2023-0286 https://nvd.nist.gov/vuln/detail/CVE-2023-0286 https://www.openssl.org/news/secadv/20230207.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=2164440
- https://access.redhat.com/errata/RHSA-2023:3354
- https://access.redhat.com/errata/RHSA-2023:1438
- https://access.redhat.com/errata/RHSA-2023:1335
- https://access.redhat.com/errata/RHSA-2023:2932
- https://access.redhat.com/errata/RHSA-2023:1405
- https://access.redhat.com/errata/RHSA-2023:1437
- https://access.redhat.com/errata/RHSA-2023:4124
- https://access.redhat.com/errata/RHSA-2023:1439
- https://access.redhat.com/errata/RHSA-2023:4252
- https://access.redhat.com/errata/RHSA-2023:1440
- https://access.redhat.com/errata/RHSA-2023:4128
- https://access.redhat.com/errata/RHSA-2023:1441
- https://access.redhat.com/errata/RHSA-2023:0946
- https://access.redhat.com/errata/RHSA-2023:2165
- https://access.redhat.com/errata/RHSA-2023:1199
- https://access.redhat.com/errata/RHSA-2023:2022
- https://access.redhat.com/errata/RHSA-2023:3355
- https://access.redhat.com/errata/RHSA-2023:3421
- https://access.redhat.com/errata/RHSA-2023:3420
- https://access.redhat.com/errata/RHSA-2023:5209
- https://access.redhat.com/security/cve/cve-2023-0286
- https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d
- https://www.openssl.org/news/secadv/20230207.txt
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167867
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167874
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167868
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167875
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167869
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167876
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167870
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167877
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167865
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167866
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167871
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167878
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167872
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167879
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167873
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167880
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2164440#c9
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2164440#c22
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2164440#c33
- https://git.centos.org/rpms/openssl/blob/3852e30e7f26cbb2cf30ce617099b3b2cb341a41/f/SOURCES/openssl-1.0.2k-cve-2023-0286-X400.patch
- https://git.centos.org/rpms/openssl/blob/2502e239760c267784da79808cd792bfe2635626/f/SOURCES/openssl-1.1.1-cve-2023-0286-X400.patch
- https://gitlab.com/redhat/centos-stream/rpms/openssl/-/blob/c9s/0107-CVE-2023-0286-X400.patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/246611
- https://www.ibm.com/support/pages/node/7009747 (Advisory)
- https://security.gentoo.org/glsa/202402-08
- https://github.com/pyca/cryptography/security/advisories/GHSA-x4qr-2fvf-3mr5
- https://nvd.nist.gov/vuln/detail/CVE-2023-0286
- https://rustsec.org/advisories/RUSTSEC-2023-0006.html
- https://github.com/advisories/GHSA-x4qr-2fvf-3mr5 (Advisory)
- https://launchpad.net/bugs/cve/CVE-2023-0286
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2f7530077e0ef79d98718138716bc51ca0cad658
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9
- https://security-tracker.debian.org/tracker/CVE-2023-0286
- https://ubuntu.com/security/notices/USN-5844-1
- https://ubuntu.com/security/notices/USN-5845-1
- https://ubuntu.com/security/notices/USN-5845-2
- https://ubuntu.com/security/notices/USN-6564-1
- https://www.cve.org/CVERecord?id=CVE-2023-0286
- https://ubuntu.com/security/CVE-2023-0286
Parent vulnerabilities
(Appears in the following advisories)
- RHSA-2023:3354
- RHSA-2023:1438
- RHSA-2023:1335
- RHSA-2023:2932
- RHSA-2023:1405
- RHSA-2023:1437
- RHSA-2023:4124
- RHSA-2023:1439
- RHSA-2023:4252
- RHSA-2023:1440
- RHSA-2023:4128
- RHSA-2023:1441
- RHSA-2023:0946
- RHSA-2023:2165
- RHSA-2023:1199
- RHSA-2023:2022
- RHSA-2023:3355
- RHSA-2023:3421
- RHSA-2023:3420
- RHSA-2023:5209
- IBM-7009747
- USN-5844-1
- USN-5845-1
- USN-5845-2
- USN-6564-1
Frequently Asked Questions
What is the vulnerability ID of this OpenSSL vulnerability?
The vulnerability ID is CVE-2023-0286.
What is the severity rating of CVE-2023-0286?
CVE-2023-0286 has a severity rating of 8.2, which is considered high.
Which software versions are affected by CVE-2023-0286?
CVE-2023-0286 affects multiple versions of OpenSSL, ranging from 1.0.2 to 3.0.8.
What is the impact of CVE-2023-0286?
CVE-2023-0286 can lead to a denial of service (DoS) due to a type confusion error related to X.400 address processing.
Where can I find more information about CVE-2023-0286 and its patch?
You can find more information about CVE-2023-0286 and its patch at the provided references.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-0286
- agent/first-publish-date
- collector/ibm-support
- agent/software-canonical-lookup-request
- agent/weakness
- agent/severity
- agent/author
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/title
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-cve
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-x4qr-2fvf-3mr5
- agent/last-modified-date
- agent/references
- agent/description
- collector/github-advisory
- agent/tags
- collector/launchpad-cve
- source/Launchpad
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- package-manager/redhat
- vendor/openssl
- canonical/openssl openssl
- version/openssl openssl/1.0.2
- version/openssl openssl/1.1.1
- version/openssl openssl/3.0.0
- vendor/stormshield
- canonical/stormshield stormshield management center
- canonical/stormshield stormshield network security
- version/stormshield stormshield network security/2.7.0
- version/stormshield stormshield network security/2.8.0
- version/stormshield stormshield network security/3.8.0
- version/stormshield stormshield network security/4.0.0
- version/stormshield stormshield network security/4.4.0
- vendor/ibm
- canonical/ibm watson knowledge catalog on-prem
- version/ibm watson knowledge catalog on-prem/4.x
- package-manager/rust
- package-manager/pip
- package-manager/debian
- package-manager/ubuntu