CVE-2023-0286

HIGH7.4EPSS 88.3%

X.400 address type confusion in X.509 `GeneralName`

發布日:2023/2/8修改日:2023/11/8

也稱為:GHSA-x4qr-2fvf-3mr5ALPINE-CVE-2023-0286CGA-2qh5-p25f-7gfqRUSTSEC-2023-0006

描述

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 `GeneralName`. X.400 addresses were parsed as an `ASN1_STRING` but the public structure definition for `GENERAL_NAME` incorrectly specified the type of the `x400Address` field as `ASN1_TYPE`. This field is subsequently interpreted by the OpenSSL function `GENERAL_NAME_cmp` as an `ASN1_TYPE` rather than an `ASN1_STRING`. When CRL checking is enabled (i.e. the application sets the `X509_V_FLAG_CRL_CHECK` flag), this vulnerability may allow an attacker to pass arbitrary pointers to a `memcmp` call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

受影響套件(6)

Alpine/opensslfrom 0, < 1.1.1t-r0
Alpine/openssl3from 0, < 3.0.8-r0
crates.io/openssl-srcfrom 0, < 111.25.0
crates.io/openssl-src>= 0.0.0-0, < 111.25.0, >= 300.0.0, < 300.0.12
Debian/opensslfrom 0, < 1.1.1n-0+deb11u4
PyPI/cryptography>= 0.8.1, < 39.0.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

描述

受影響套件(6)

CVSS 分數

參考連結(16)