REDHAT-BUG-2164500
First published: Wed Jan 25 2023(Updated: )
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenSSL |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2160756
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2160837
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167851
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167859
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167852
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167858
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167853
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167860
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167854
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167861
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167850
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167849
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167855
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167862
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167856
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167863
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167857
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2167864
- https://access.redhat.com/errata/RHSA-2023:0946
- https://access.redhat.com/errata/RHSA-2023:1199
- https://access.redhat.com/security/cve/cve-2023-0401
- https://bugzilla.redhat.com/show_bug.cgi?id=2164500
- agent/references
- agent/type
- agent/first-publish-date
- agent/severity
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-0401
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openssl
- canonical/openssl