REDHAT-BUG-2224962: Low severity OpenSSL OpenSSL vulnerability
Applications that use the functions DHcheck(), DHcheckex() or EVPPKEYparamcheck() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.
Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option.
The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
http://www.openwall.com/lists/oss-security/2023/07/19/4 http://www.openwall.com/lists/oss-security/2023/07/19/5 http://www.openwall.com/lists/oss-security/2023/07/19/6 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23 https://www.openssl.org/news/secadv/20230719.txt
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2224962?
REDHAT-BUG-2224962 is categorized as a Denial of Service vulnerability.
How do I fix REDHAT-BUG-2224962?
To mitigate REDHAT-BUG-2224962, ensure that only trusted sources are used when supplying DH keys or parameters.
What applications are affected by REDHAT-BUG-2224962?
Applications utilizing the functions DH_check(), DH_check_ex(), or EVP_PKEY_param_check() are affected by REDHAT-BUG-2224962.
What can happen if REDHAT-BUG-2224962 is exploited?
If exploited, REDHAT-BUG-2224962 can lead to long delays or Denial of Service in the affected applications.
Which versions of OpenSSL are vulnerable to REDHAT-BUG-2224962?
OpenSSL versions ranging from 1.0.2 to 3.1 are vulnerable to REDHAT-BUG-2224962.