OpenSSL X.400 Address Type Confusion Vulnerability
Summary
RLSA-2023:0946: Important: openssl security and bug fix update. Affects openssl versions < 1:3.0.1-47.el9_1. Fixed in 1:3.0.1-47.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. It also serves as a general-purpose cryptography library. The vulnerability identified as CVE-2023-0286 affects OpenSSL versions prior to 1:3.0.1-47.el9_1 on Rocky Linux 9. This vulnerability arises due to a type confusion issue in the X.509 GeneralName field of X.400 addresses.
Vulnerability Detail
The X.400 address type confusion vulnerability in OpenSSL allows an attacker to manipulate X.509 certificates and potentially execute arbitrary code. By crafting a malicious certificate, an attacker can exploit this vulnerability to cause a denial of service (DoS) or execute arbitrary code on a vulnerable system. This vulnerability has a CVSS score of 7.5, indicating its high severity.
How To Fix
Minimum fixed version
1:3.0.1-47.el9_1
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official security patch or update the affected package to the latest version.
Conclusion
The OpenSSL X.400 Address Type Confusion Vulnerability (CVE-2023-0286) poses a significant risk to systems running vulnerable versions of OpenSSL. To mitigate this vulnerability, it is crucial to update OpenSSL to version 1:3.0.1-47.el9_1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is a widely used toolkit that implements SSL and TLS protocols, providing cryptographic functions and secure communication capabilities.
This vulnerability allows an attacker to manipulate X.509 certificates and potentially execute arbitrary code, leading to a denial of service or remote code execution.
To fix this vulnerability, update OpenSSL to version 1:3.0.1-47.el9_1 or later by applying the relevant security and bug fix updates provided by the Rocky Linux distribution.
No, there is no known workaround for this vulnerability. It is crucial to apply the official security patch or update the affected package to the latest version.
The CVSS score of this vulnerability is 7.5, indicating its high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
