CVE-2023-1255
First published: Thu Apr 20 2023(Updated: )
OpenSSL is vulnerable to a denial of service, caused by a flaw in the AES-XTS cipher decryption implementation for 64 bit ARM platform. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause the application to crash.
Credit: openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/openssl | <=3.0.8-1<=1.1.1-1 | 3.0.9-1 3.1.1-1 1.1.1n-0+deb11u5 |
| OpenSSL OpenSSL | >=3.0.0<3.0.9 | |
| OpenSSL OpenSSL | >=3.1.0<3.1.1 | |
| IBM QRadar WinCollect Agent | <=10.0-10.1.7 | |
| redhat/OpenSSL | <3.1.1 | 3.1.1 |
| redhat/OpenSSL | <3.0.9 | 3.0.9 |
| ubuntu/openssl | <3.0.2-0ubuntu1.10 | 3.0.2-0ubuntu1.10 |
| ubuntu/openssl | <3.0.5-2ubuntu2.3 | 3.0.5-2ubuntu2.3 |
| ubuntu/openssl | <3.0.8-1ubuntu1.2 | 3.0.8-1ubuntu1.2 |
| ubuntu/openssl | <3.0.8-1ubuntu3 | 3.0.8-1ubuntu3 |
| debian/openssl | 1.1.1n-0+deb10u3 1.1.1n-0+deb10u6 1.1.1w-0+deb11u1 1.1.1n-0+deb11u5 3.0.11-1~deb12u2 3.1.4-2 3.1.5-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2023-1255
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=02ac9c9420275868472f33b01def01218742b8bb
- https://www.openssl.org/news/secadv/20230420.txt
- https://security-tracker.debian.org/tracker/CVE-2023-0466
- https://www.openssl.org/news/secadv/20230328.txt
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=51e8a84ce742db0f6c70510d0159dad8f7825908
- https://security-tracker.debian.org/tracker/CVE-2023-0465
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1dd43e0709fece299b15208f36cc7c76209ba0bb
- https://security-tracker.debian.org/tracker/CVE-2023-0464
- https://www.openssl.org/news/secadv/20230322.txt
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1
- https://www.cve.org/CVERecord?id=CVE-2023-1255
- https://www.cve.org/CVERecord?id=CVE-2023-0466
- https://www.cve.org/CVERecord?id=CVE-2023-0465
- https://www.cve.org/CVERecord?id=CVE-2023-0464
- https://security-tracker.debian.org/tracker/CVE-2022-4304
- https://security-tracker.debian.org/tracker/CVE-2023-2650
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034720
- https://exchange.xforce.ibmcloud.com/vulnerabilities/253370
- https://www.ibm.com/support/pages/node/7081403 (Advisory)
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=02ac9c9420275868472f33b01def01218742b8bb
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bc2f61ad70971869b242fc1cb445b98bad50074a
- https://www.openssl.org/news/secadv/20230419.txt
- https://security.netapp.com/advisory/ntap-20230908-0006/
- https://launchpad.net/bugs/cve/CVE-2023-1255
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2188528
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2188530
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2188529
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2188531
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2188526
- https://access.redhat.com/errata/RHSA-2023:3722
- https://access.redhat.com/security/cve/cve-2023-1255
- https://bugzilla.redhat.com/show_bug.cgi?id=2188461
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1255
- https://ubuntu.com/security/notices/USN-6119-1
- https://nvd.nist.gov/vuln/detail/CVE-2023-1255
- https://git.openssl.org/?p=openssl.git;a=commit;h=02ac9c9420275868472f33b01def01218742b8bb (3.0.x)
- https://ubuntu.com/security/CVE-2023-1255
Frequently Asked Questions
What is CVE-2023-1255?
CVE-2023-1255 is a vulnerability in the AES-XTS cipher decryption implementation for the 64-bit ARM platform that can cause crashes due to reading past the input buffer.
Who is affected by CVE-2023-1255?
Applications using the AES-XTS algorithm on the 64-bit ARM platform may be affected.
What is the severity of CVE-2023-1255?
The severity of CVE-2023-1255 is high with a CVSS score of 5.9.
How can I fix CVE-2023-1255?
To fix CVE-2023-1255, update the affected OpenSSL package to the recommended versions: 3.0.2-0ubuntu1.10, 3.0.5-2ubuntu2.3, 3.0.8-1ubuntu1.2, 3.0.9-1, 3.1.1-1, or 1.1.1n-0+deb11u5.
Where can I find more information about CVE-2023-1255?
More information about CVE-2023-1255 can be found at the following links: [link1], [link2], [link3].
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/debian-bugs
- alias/CVE-2023-1255
- collector/ibm-support
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-api
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- collector/security-tracker-debian
- source/Debian
- collector/usn-cve
- source/Ubuntu
- package-manager/debian
- vendor/ibm
- canonical/ibm qradar wincollect agent
- version/ibm qradar wincollect agent/10.0-10.1.7
- vendor/openssl
- canonical/openssl openssl
- version/openssl openssl/3.0.0
- version/openssl openssl/3.1.0
- package-manager/redhat
- package-manager/ubuntu