CVE-2023-2650: Possible DoS translating ASN.1 object identifiers
Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.
Impact summary: Applications that use OBJobj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service.
Other sources
OpenSSL is vulnerable to a denial of service, caused by a flaw when using OBJobj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1n-0+deb11u5Fixed in 3.0.14-1~deb12u1Fixed in 3.0.14-1~deb12u2Fixed in 3.3.2-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.117.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.1
Event History
Frequently Asked Questions
What is CVE-2023-2650?
CVE-2023-2650 is a vulnerability that allows specially crafted ASN.1 object identifiers or data containing them to cause slow processing in OpenSSL.
What is the impact of CVE-2023-2650?
Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF, or TS with no message size limit may experience slow performance.
What is the severity of CVE-2023-2650?
CVE-2023-2650 has a severity rating of 6.5 (medium).
How can I fix CVE-2023-2650?
To fix CVE-2023-2650, upgrade OpenSSL to version 1.1.1u, 1.1.1n, or 3.0.9 or apply the necessary updates provided by your operating system vendor.
Where can I find more information about CVE-2023-2650?
You can find more information about CVE-2023-2650 on the OpenSSL website and the official CVE entry.