DeutschShown in its original language — a full translation is planned for a future version.
OpenSSL: Mehrere Schwachstellen
view advisory published 2023-02-07
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder Chiffretext über ein Netzwerk wiederherzustellen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-4203US | medium4.9 | — | ||
A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verifica… | ||||
| CVE-2023-0401US | high7.5 | — | ||
A NULL pointer can be dereferenced when signatures are being
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
algorithm used for the signature is known to the… | ||||
| CVE-2023-0286US | high7.4 | — | ||
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure def… | ||||
| CVE-2023-0217US | high7.5 | — | ||
An invalid pointer dereference on read can be triggered when an
application tries to check a malformed DSA public key by the
EVP_PKEY_public_check() function. This will most likely… | ||||
| CVE-2023-0216US | high7.5 | — | ||
An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
T… | ||||
| CVE-2023-0215US | high7.5 | — | ||
The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 st… | ||||
| CVE-2022-4450US | high7.5 | — | ||
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds th… | ||||
| CVE-2022-4304US | medium5.9 | Exploit | ||
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack.… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2023-0946 vom 2023-02-28external
- Oracle Linux Security Advisory ELSA-2023-1335 vom 2023-03-20external
- Oracle Linux Security Advisory ELSA-2023-1405 vom 2023-03-23external
- Red Hat Security Advisory RHSA-2023:0946 vom 2023-02-28external
- Red Hat Security Advisory RHSA-2023:1199 vom 2023-03-14external
- Red Hat Security Advisory RHSA-2023:1335 vom 2023-03-20external
- Red Hat Security Advisory RHSA-2023:1405 vom 2023-03-22external
- Red Hat Security Advisory RHSA-2023:2022 vom 2023-04-26external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan