OpenSSL X.400 Address Type Confusion Vulnerability
Summary
ALSA-2023:1405: Important: openssl security update. Affects openssl versions < 1:1.1.1k-9.el8_7. Fixed in 1:1.1.1k-9.el8_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a general-purpose cryptography library. It provides cryptographic functionality to secure communications over computer networks. The OpenSSL package is vulnerable to an X.400 address type confusion vulnerability.
Vulnerability Detail
The X.400 address type confusion vulnerability in OpenSSL (CVE-2023-0286) allows an attacker to exploit a flaw in the X.509 GeneralName handling. By manipulating a specially crafted certificate, an attacker can cause a type confusion error, leading to potential remote code execution or denial of service. This vulnerability has a CVSS score of [insert score].
How To Fix
Minimum fixed version
1:1.1.1k-9.el8_7
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The OpenSSL X.400 address type confusion vulnerability can be mitigated by updating the OpenSSL package to version 1.1.1k-9.el8_7 or later. It is important to regularly update software packages to protect against known vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is a toolkit that implements the SSL and TLS protocols, as well as a general-purpose cryptography library.
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability.
Yes, a patch is available in the OpenSSL package version 1.1.1k-9.el8_7 or later.
You can refer to the CVE page(s) listed in the References section of the vulnerability details for more information.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
