Vulnerability · Published Feb 8, 2023 · Assigned by openssl
CVE-2023-0217NULL dereference validating DSA public key
High 7.5
In plain English
A high-severity null pointer dereference in OpenSSL from OpenSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | openssl | 1:3.0.1-47.el9_1 | ALSA-2023:0946 |
| AlmaLinux:9 | openssl-devel | 1:3.0.1-47.el9_1 | ALSA-2023:0946 |
| AlmaLinux:9 | openssl-libs | 1:3.0.1-47.el9_1 | ALSA-2023:0946 |
| AlmaLinux:9 | openssl-perl | 1:3.0.1-47.el9_1 | ALSA-2023:0946 |
| Alpine:v3.20 | openssl | 3.0.8-r0 | ALPINE-CVE-2023-0217 |
| Alpine:v3.21 | openssl | 3.0.8-r0 | ALPINE-CVE-2023-0217 |
| Alpine:v3.22 | openssl | 3.0.8-r0 | ALPINE-CVE-2023-0217 |
| Alpine:v3.23 | openssl | 3.0.8-r0 | ALPINE-CVE-2023-0217 |
| Alpine:v3.24 | openssl | 3.0.8-r0 | ALPINE-CVE-2023-0217 |
| Debian:12 | openssl | 3.0.8-1 | DEBIAN-CVE-2023-0217 |
| Debian:13 | openssl | 3.0.8-1 | DEBIAN-CVE-2023-0217 |
| Debian:14 | openssl | 3.0.8-1 | DEBIAN-CVE-2023-0217 |
| Rocky Linux:9 | openssl | 1:3.0.1-47.el9_1 | RLSA-2023:0946 |
| Ubuntu:22.04:LTS | openssl | 3.0.2-0ubuntu1.8 | UBUNTU-CVE-2023-0217 |
| Ubuntu:22.04:LTS | openssl | 3.0.2-0ubuntu1.8 | USN-5844-1 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H