CVE-2023-0216
Invalid pointer dereference in d2i_PKCS7 functions
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
The result of the dereference is an application crash which could
lead to a denial of service attack. The TLS implementation in OpenSSL
does not call this function however third party applications might
call these functions on untrusted data.
A flaw was found in OpenSSL. An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. This may result in an application crash which could lead to a denial of service. The TLS implementation in OpenSSL does not call this function, however, third party applications might call these functions on untrusted data.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-01-11 CVE Reserved
- 2023-02-07 CVE Published
- 2024-08-02 CVE Updated
- 2024-09-29 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-476: NULL Pointer Dereference
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://security.gentoo.org/glsa/202402-08 |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6 | 2024-02-04 |
| URL | Date | SRC |
|---|---|---|
| https://www.openssl.org/news/secadv/20230207.txt | 2024-02-04 | |
| https://access.redhat.com/security/cve/CVE-2023-0216 | 2023-03-14 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2164497 | 2023-03-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | >= 3.0.0 <= 3.0.7 Search vendor "Openssl" for product "Openssl" and version " >= 3.0.0 <= 3.0.7" | - |
Affected
| ||||||
| Stormshield Search vendor "Stormshield" | Stormshield Management Center Search vendor "Stormshield" for product "Stormshield Management Center" | < 3.3.3 Search vendor "Stormshield" for product "Stormshield Management Center" and version " < 3.3.3" | - |
Affected
| ||||||