REDHAT-BUG-2430390: Low severity OpenSSL OpenSSL vulnerability
Severity: Low
Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data.
Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7digestfromattributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service.
The function PKCS7digestfromattributes() accesses the message digest attribute value without validating its type. When the type is not VASN1OCTETSTRING, this results in accessing invalid memory through the ASN1TYPE union, causing a crash.
Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be using the CMS API instead. For these reasons the issue was assessed as Low severity.
The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.1.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.5.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.4.
OpenSSL 3.3 users should upgrade to OpenSSL 3.3.6.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.19.
OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1ze. (premium support customers only).
OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zn. (premium support customers only).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 1.0.2zn - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 1.1.1ze - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.0.19 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.3.6 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.4.4 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.5.5 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.6.1 - Compensating control
Use the CMS API instead of the legacy PKCS7 API for signature verification of signed PKCS#7 data, since the crash/invalid memory access occurs in PKCS7 parsing when ASN1_TYPE union members are accessed without validating their type.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2430390?
The severity of REDHAT-BUG-2430390 is classified as low.
What causes the vulnerability REDHAT-BUG-2430390?
REDHAT-BUG-2430390 is caused by a type confusion vulnerability in the signature verification of signed PKCS#7 data without proper type validation.
Which software versions are affected by REDHAT-BUG-2430390?
Affected software versions for REDHAT-BUG-2430390 include OpenSSL versions 1.0.2, 1.1.1, 3.0, 3.3, 3.4, 3.5, and 3.6.
How do I fix REDHAT-BUG-2430390?
To fix REDHAT-BUG-2430390, users should upgrade to the latest patched version of OpenSSL.
What impact does REDHAT-BUG-2430390 have if exploited?
If exploited, REDHAT-BUG-2430390 can lead to an invalid or NULL pointer dereference when processing malformed PKCS#7 data.