CVE-2023-2975

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.

• CWE-354
• CWE-287

• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598Patch
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdcPatch
• https://www.openssl.org/news/secadv/20230714.txtVendor Advisory
• http://www.openwall.com/lists/oss-security/2023/07/15/1
• http://www.openwall.com/lists/oss-security/2023/07/19/5
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598Patch
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdcPatch
• https://security.gentoo.org/glsa/202402-08
• https://security.netapp.com/advisory/ntap-20230725-0004/
• https://www.openssl.org/news/secadv/20230714.txtVendor Advisory

Published

Jul 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29743An issue found in BestWeather v.7.3.1 for Android allows una…7.5
• CVE-2023-29745An issue found in BestWeather v.7.3.1 for Android allows una…7.1
• CVE-2023-29746An issue found in The Thaiger v.1.2 for Android allows unaut…9.8
• CVE-2023-29747Story Saver for Instragram - Video Downloader 1.0.6 for Andr…9.8
• CVE-2023-29748Story Saver for Instragram - Video Downloader 1.0.6 for Andr…7.5
• CVE-2023-29749An issue found in Yandex Navigator v.6.60 for Android allows…7.8
• CVE-2023-29751An issue found in Yandex Navigator v.6.60 for Android allows…5.5
• CVE-2023-29752An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Andr…7.8
• CVE-2023-29753An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Andr…5.5
• CVE-2023-29755An issue found in Twilight v.13.3 for Android allows unautho…7.8
• CVE-2023-29756An issue found in Twilight v.13.3 for Android allows unautho…5.5
• CVE-2023-29757An issue found in Blue Light Filter v.1.5.5 for Android allo…7.8