CVE-2023-0216
08.02.2023, 20:15
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openssl | openssl | 3.0.0 ≤ 𝑥 ≤ 3.0.7 |
| stormshield | stormshield_management_center | 𝑥 < 3.3.3 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| edk2 |
| ||||||||||||||||
| nodejs |
| ||||||||||||||||
| openssl |
| ||||||||||||||||
| openssl1.0 |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libopenssl-3-devel |
| ||||||||||||||||||||||||
| libopenssl-3-fips-provider |
| ||||||||||||||||||||||||
| libopenssl-3-fips-provider-32bit |
| ||||||||||||||||||||||||
| libopenssl3 |
| ||||||||||||||||||||||||
| libopenssl3-32bit |
| ||||||||||||||||||||||||
| openssl-3 |
|
Red Hat Enterprise Linux Releases
Common Weakness Enumeration
References