DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
OpenSSL: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-02-07
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder Chiffretext über ein Netzwerk wiederherzustellen.
01
beschreibt (8)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-4203US | medium4.9 | — | ||
A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verifica… | ||||
| CVE-2023-0401US | high7.5 | — | ||
A NULL pointer can be dereferenced when signatures are being
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
algorithm used for the signature is known to the… | ||||
| CVE-2023-0286US | high7.4 | — | ||
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure def… | ||||
| CVE-2023-0217US | high7.5 | — | ||
An invalid pointer dereference on read can be triggered when an
application tries to check a malformed DSA public key by the
EVP_PKEY_public_check() function. This will most likely… | ||||
| CVE-2023-0216US | high7.5 | — | ||
An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
T… | ||||
| CVE-2023-0215US | high7.5 | — | ||
The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 st… | ||||
| CVE-2022-4450US | high7.5 | — | ||
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds th… | ||||
| CVE-2022-4304US | medium5.9 | Exploit | ||
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack.… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Oracle Linux Security Advisory ELSA-2023-0946 vom 2023-02-28external
- Oracle Linux Security Advisory ELSA-2023-1335 vom 2023-03-20external
- Oracle Linux Security Advisory ELSA-2023-1405 vom 2023-03-23external
- Red Hat Security Advisory RHSA-2023:0946 vom 2023-02-28external
- Red Hat Security Advisory RHSA-2023:1199 vom 2023-03-14external
- Red Hat Security Advisory RHSA-2023:1335 vom 2023-03-20external
- Red Hat Security Advisory RHSA-2023:1405 vom 2023-03-22external
- Red Hat Security Advisory RHSA-2023:2022 vom 2023-04-26external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan