Strix
26.1K

CVE-2023-0286

HIGHCVSS 7.4/10EPSS 59.50%

Last modified

CVE-2023-0286 is a high-severity vulnerability rated 7.4/10 on the CVSS scale. There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. EPSS estimates a 59.50% chance of exploitation in the next 30 days.

Description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Metrics

CVSS 3.1
7.4/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Probability
59.50%

99.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
OpensslOpenssl>= 1.0.2, < 1.0.2zg
OpensslOpenssl>= 1.1.1, < 1.1.1t
OpensslOpenssl>= 3.0.0, < 3.0.8
StormshieldStormshield Management Center< 3.3.3
StormshieldStormshield Network Security>= 2.7.0, < 2.7.11
StormshieldStormshield Network Security>= 2.8.0, < 3.7.34
StormshieldStormshield Network Security>= 3.8.0, < 3.11.22
StormshieldStormshield Network Security>= 4.0.0, < 4.3.16
StormshieldStormshield Network Security>= 4.4.0, < 4.6.3

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-0286?
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
How severe is CVE-2023-0286?
CVE-2023-0286 has a CVSS score of 7.4/10 (HIGH severity). The EPSS model estimates a 59.50% probability of exploitation in the next 30 days.
How do I fix CVE-2023-0286?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-0286?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST