Denial of Service Vulnerability in OpenSSL Affecting Node.js and OpenSSL Packages
Summary
UBUNTU-CVE-2023-6237: Issue summary: Checking excessively long invalid RSA public keys may take a long time. Affects nodejs versions 12.22.5~dfsg-5ubuntu1 – 12.22.9~dfsg-1ubuntu3.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used library that provides cryptographic functions and secure communication protocols. It is integral to many applications, including Node.js, which relies on OpenSSL for its SSL/TLS capabilities. The vulnerability in question affects the EVP_PKEY_public_check() function, which is used to validate RSA public keys. This vulnerability can lead to significant delays in applications that utilize this function, particularly when processing keys from untrusted sources.
Vulnerability Detail
The vulnerability arises from the handling of excessively long invalid RSA public keys by the EVP_PKEY_public_check() function in OpenSSL. When an application checks an RSA public key that is overly large, the computation to verify the RSA modulus can take an excessive amount of time, leading to potential Denial of Service (DoS) attacks. This is particularly concerning for applications that receive keys from untrusted sources, as it could allow an attacker to exploit this delay to disrupt service availability. The OpenSSL 3.0 and 3.1 FIPS providers are specifically affected by this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the EVP_PKEY_public_check() function with RSA keys obtained from untrusted sources. If possible, implement additional validation checks on the keys before passing them to this function to mitigate the risk of DoS attacks.
Conclusion
The vulnerability identified in OpenSSL poses a risk of Denial of Service attacks through the improper handling of RSA public keys. It is crucial for users of affected packages, such as Node.js and OpenSSL, to apply the necessary updates to protect their applications. Utilizing tools like Vulert can aid in monitoring and managing these vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
The affected packages include 'nodejs' and 'openssl' on Ubuntu 22.04 LTS, as well as related libraries like 'libssl-dev' and 'libssl3'.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The primary impact is a Denial of Service (DoS) attack, where applications may experience long delays when processing RSA public keys from untrusted sources, potentially leading to service disruptions.
Yes, there are patched versions available for the affected packages. It is recommended to update to the latest versions to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
