CVE-2023-6237: Excessive time spent checking invalid RSA public keys
Applications that use the function EVPPKEYpubliccheck() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service. An application that calls EVPPKEYpubliccheck() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack.
The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. OpenSSL versions 3.0.0 to 3.0.12, 3.1.0 to 3.1.4 and 3.2.0 are vulnerable to this issue. OpenSSL versions 1.1.1 and 1.0.2 are not affected by this issue.
References: https://www.openssl.org/news/secadv/20240115.txt https://www.openwall.com/lists/oss-security/2024/01/15/2
Upstream fix: https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a (3.0.13) https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 (3.1.5) https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d (3.2.1)
Other sources
Excessive time spent checking invalid RSA public keys
— Microsoft
Issue summary: Checking excessively long invalid RSA public keys may take a long time.
Impact summary: Applications that use the function EVPPKEYpubliccheck() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service.
When function EVPPKEYpubliccheck() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time.
An application that calls EVPPKEYpubliccheck() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack.
The function EVPPKEYpubliccheck() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the '-pubin' and '-check' options on untrusted data.
The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.
— MITRE
OpenSSL is vulnerable to a denial of service, caused by a flaw in the handling of RSA public keys by the EVPPKEYpubliccheck() function. By persuading a victim to sue a specially crafted RSA public keys for verification, a remote attacker could exploit this vulnerability to cause long delays, and results in a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u2Fixed in 3.0.15-1~deb12u1Fixed in 3.0.14-1~deb12u2Fixed in 3.5.0-1 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 3.0.13 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 3.1.5 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 3.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.1-6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 38.0.72.2-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.14.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in - - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.2-1 - Upgrade
Upgrade
opensslto a version that resolves this vulnerability.Fixed in 3.0.13Patch 18c02492138d1eb8b6548cb26e7b625fb2414a2a - Upgrade
Upgrade
opensslto a version that resolves this vulnerability.Fixed in 3.1.5Patch a830f551557d3d66a84bbb18a5b889c640c36294 - Upgrade
Upgrade
opensslto a version that resolves this vulnerability.Fixed in 3.2.1Patch 0b0f7abfb37350794a4b8960fafc292cd5d1b84d - Configuration
Avoid running the OpenSSL pkey command line with the '-pubin' and '-check' options on untrusted RSA public key material to prevent excessive time checking invalid RSA public keys (DoS).
OpenSSL pkey command line application -pubin and -check options usage = Do not use on untrusted data
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6237?
CVE-2023-6237 has a severity level that can lead to Denial of Service (DoS) due to long delays in processing RSA public keys from untrusted sources.
How do I fix CVE-2023-6237?
To fix CVE-2023-6237, update your affected software to the latest patched versions provided by your vendor.
Which applications are affected by CVE-2023-6237?
CVE-2023-6237 affects IBM Cognos Analytics versions 12.0.0-12.0.3 and 11.2.0-11.2.4 FP4, as well as OpenSSL packages up to specific versions.
What functions are related to CVE-2023-6237?
CVE-2023-6237 is related to the EVP_PKEY_public_check() function used for checking RSA public keys.
Can untrusted RSA public keys cause problems in CVE-2023-6237?
Yes, using untrusted RSA public keys with EVP_PKEY_public_check() can lead to significant delays and potential Denial of Service.