Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS12eHJoLWNwZzctOHZqcs4AAxfp
openssl-src subject to NULL dereference validating DSA public key
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack.
The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.
Permalink: https://github.com/advisories/GHSA-vxrh-cpg7-8vjrJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12eHJoLWNwZzctOHZqcs4AAxfp
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 10 months ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Identifiers: GHSA-vxrh-cpg7-8vjr, CVE-2023-0217
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-0217
- https://rustsec.org/advisories/RUSTSEC-2023-0012.html
- https://www.openssl.org/news/secadv/20230207.txt
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=23985bac83fd50c8e29431009302b5442f985096
- https://security.gentoo.org/glsa/202402-08
- https://github.com/advisories/GHSA-vxrh-cpg7-8vjr
Affected Packages
cargo:openssl-src
Dependent packages: 13Dependent repositories: 3,600
Downloads: 28,233,199 total
Affected Version Ranges: >= 300.0.0, < 300.0.12
Fixed in: 300.0.12
All affected versions: 300.0.0, 300.0.1, 300.0.2, 300.0.3, 300.0.4, 300.0.5, 300.0.6, 300.0.7, 300.0.8, 300.0.9, 300.0.10, 300.0.11
All unaffected versions: 110.0.0, 110.0.0, 110.0.1, 110.0.2, 110.0.3, 110.0.4, 110.0.5, 110.0.6, 110.0.7, 111.0.0, 111.0.1, 111.1.0, 111.1.1, 111.2.1, 111.3.0, 111.4.0, 111.5.0, 111.6.0, 111.6.1, 111.7.0, 111.8.0, 111.8.1, 111.9.0, 111.10.0, 111.10.1, 111.10.2, 111.11.0, 111.12.0, 111.13.0, 111.14.0, 111.15.0, 111.16.0, 111.17.0, 111.18.0, 111.19.0, 111.20.0, 111.21.0, 111.22.0, 111.23.0, 111.24.0, 111.25.0, 111.25.1, 111.25.2, 111.25.3, 111.26.0, 111.27.0, 111.28.0, 111.28.1, 111.28.2, 300.0.12, 300.0.13, 300.1.0, 300.1.1, 300.1.2, 300.1.3, 300.1.4, 300.1.5, 300.1.6, 300.2.0, 300.2.1, 300.2.2, 300.2.3, 300.3.0, 300.3.1, 300.3.2, 300.4.0, 300.4.1