OpenSSL Moderate Vulnerability: openssl security and bug fix update
Summary
ALSA-2023:3722: Moderate: openssl security and bug fix update. Affects openssl versions < 1:3.0.7-16.el9_2. Fixed in 1:3.0.7-16.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, providing cryptographic functions for secure communication. It is a general-purpose cryptography library that offers encryption, decryption, digital signatures, and more. This vulnerability affects the OpenSSL package in AlmaLinux 9.0.
Vulnerability Detail
The vulnerability in OpenSSL includes several security issues and bug fixes. The security issues include:
- CVE-2023-2650: Possible denial of service (DoS) due to translating ASN.1 object identifiers.
- CVE-2023-0464: Denial of service by excessive resource usage in verifying X509 policy constraints.
- CVE-2023-0465: Invalid certificate policies in leaf certificates are silently ignored.
- CVE-2023-0466: Certificate policy check not enabled.
- CVE-2023-1255: Input buffer over-read in AES-XTS implementation on 64-bit ARM.
These vulnerabilities can lead to various impacts, including DoS attacks, bypassing certificate policies, and information disclosure.
How To Fix
Minimum fixed version
1:3.0.7-16.el9_2
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
OpenSSL has released a security and bug fix update to address multiple vulnerabilities. It is recommended to update the OpenSSL package to the latest version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is a toolkit that implements SSL and TLS protocols, providing cryptographic functions for secure communication.
The vulnerabilities can lead to DoS attacks, bypassing certificate policies, and information disclosure.
Update the OpenSSL package to version 1:3.0.7-16.el9_2 or later using the package manager.
No specific workarounds are mentioned for these vulnerabilities.
You can refer to the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
