Log in Start free

Vulnerability · Published Feb 8, 2023 · Assigned by openssl

CVE-2023-0286X.400 address type confusion in X.509 GeneralName

High 7.4

In plain English

A high-severity type confusion in OpenSSL from OpenSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 69.3% (higher than 99.4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)69.3%top 0.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8compat-openssl101:1.0.2o-4.el8_10.1ALSA-2025:7895
AlmaLinux:9compat-openssl111:1.1.1k-5.el9_6.1ALSA-2025:7937
AlmaLinux:8edk2-aarch6420220126gitbb1bba3d77-4.el8ALSA-2023:2932
AlmaLinux:9edk2-aarch6420221207gitfff6d81270b5-9.el9_2ALSA-2023:2165
AlmaLinux:8edk2-ovmf20220126gitbb1bba3d77-4.el8ALSA-2023:2932
AlmaLinux:9edk2-ovmf20221207gitfff6d81270b5-9.el9_2ALSA-2023:2165
AlmaLinux:9edk2-tools20221207gitfff6d81270b5-9.el9_2ALSA-2023:2165
AlmaLinux:9edk2-tools-doc20221207gitfff6d81270b5-9.el9_2ALSA-2023:2165
AlmaLinux:8openssl1:1.1.1k-9.el8_7ALSA-2023:1405
AlmaLinux:9openssl1:3.0.1-47.el9_1ALSA-2023:0946
AlmaLinux:8openssl-devel1:1.1.1k-9.el8_7ALSA-2023:1405
AlmaLinux:9openssl-devel1:3.0.1-47.el9_1ALSA-2023:0946
AlmaLinux:8openssl-libs1:1.1.1k-9.el8_7ALSA-2023:1405
AlmaLinux:9openssl-libs1:3.0.1-47.el9_1ALSA-2023:0946
AlmaLinux:8openssl-perl1:1.1.1k-9.el8_7ALSA-2023:1405
AlmaLinux:9openssl-perl1:3.0.1-47.el9_1ALSA-2023:0946
Alpine:v3.20openssl3.0.8-r0ALPINE-CVE-2023-0286
Alpine:v3.21openssl3.0.8-r0ALPINE-CVE-2023-0286
Alpine:v3.22openssl3.0.8-r0ALPINE-CVE-2023-0286
Alpine:v3.23openssl3.0.8-r0ALPINE-CVE-2023-0286
Alpine:v3.24openssl3.0.8-r0ALPINE-CVE-2023-0286
Debian:12openssl3.0.8-1DEBIAN-CVE-2023-0286
Debian:13openssl3.0.8-1DEBIAN-CVE-2023-0286
Debian:14openssl3.0.8-1DEBIAN-CVE-2023-0286
PyPIcryptography39.0.1GHSA-x4qr-2fvf-3mr5
PyPIcryptography39.0.1PYSEC-2026-800
Rocky Linux:8compat-openssl101:1.0.2o-4.el8_10.1RLSA-2025:7895
Rocky Linux:9compat-openssl111:1.1.1k-5.el9_6.1RLSA-2025:7937
Rocky Linux:8openssl1:1.1.1k-9.el8_7RLSA-2023:1405
Rocky Linux:9openssl1:3.0.1-47.el9_1RLSA-2023:0946
Ubuntu:22.04:LTSedk22022.02-3ubuntu0.22.04.4USN-7894-1
Ubuntu:22.04:LTSedk22022.02-3ubuntu0.22.04.4UBUNTU-CVE-2023-0286
Ubuntu:24.04:LTSedk22024.02-2ubuntu0.6USN-7894-1
Ubuntu:22.04:LTSnodejs12.22.9~dfsg-1ubuntu3.3USN-6564-1
Ubuntu:22.04:LTSnodejs12.22.9~dfsg-1ubuntu3.3UBUNTU-CVE-2023-0286
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.8USN-5844-1
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.8UBUNTU-CVE-2023-0286

Affected products (as reported)

VendorProductVersions
OpenSSL OpenSSL 3.0.0 – before 3.0.81.1.1 – before 1.1.1t1.0.2 – before 1.0.2zg

Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

References