[RUSTSEC-2023-0006] X.400 address type confusion in X.509 `GeneralName`
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName
. X.400 addresses were parsed as an ASN1_STRING
but
the public structure definition for GENERAL_NAME
incorrectly specified the type
of the x400Address
field as ASN1_TYPE
. This field is subsequently interpreted by
the OpenSSL function GENERAL_NAME_cmp
as an ASN1_TYPE
rather than an
ASN1_STRING
.
When CRL checking is enabled (i.e. the application sets the
X509_V_FLAG_CRL_CHECK
flag), this vulnerability may allow an attacker to pass
arbitrary pointers to a memcmp
call, enabling them to read memory contents or
enact a denial of service. In most cases, the attack requires the attacker to
provide both the certificate chain and CRL, neither of which need to have a
valid signature. If the attacker only controls one of these inputs, the other
input must already contain an X.400 address as a CRL distribution point, which
is uncommon. As such, this vulnerability is most likely to only affect
applications which have implemented their own functionality for retrieving CRLs
over a network.
Package | Affected Version |
---|---|
pkg:cargo/openssl-src | < 300.0.12 |
Package | Fixed Version |
---|---|
pkg:cargo/openssl-src | >= 111.25, < 300.0 |
pkg:cargo/openssl-src | >= 300.0.12 |
- ID
- RUSTSEC-2023-0006
- Severity
- high
- Severity from
- CVE-2023-0286
- Impact
-
Denial Of Service
Memory Exposure - URL
- https://rustsec.org/advisories/RUSTSEC-2023-0006.html
- Published
-
2023-02-07T00:00:00
(19 months ago) - Modified
-
2023-06-13T13:10:24
(15 months ago) - Other Advisories
-
- ALAS-2023-1683
- ALAS2-2023-1934
- ALAS2-2023-1935
- ALAS2-2024-2502
- ALPINE:CVE-2023-0286
- ALSA-2023:0946
- ALSA-2023:1405
- ALSA-2023:2165
- ALSA-2023:2932
- DSA-5343-1
- ELSA-2023-0946
- ELSA-2023-12152
- ELSA-2023-12205
- ELSA-2023-12210
- ELSA-2023-12213
- ELSA-2023-12297
- ELSA-2023-12326
- ELSA-2023-13024
- ELSA-2023-13025
- ELSA-2023-13026
- ELSA-2023-13027
- ELSA-2023-1335
- ELSA-2023-1405
- ELSA-2023-2165
- ELSA-2023-2932
- ELSA-2023-32790
- ELSA-2023-32791
- FEDORA-2023-57f33242bc
- FEDORA-2023-a5564c0a3f
- FEDORA-2023-e1ffb79ddf
- FEDORA-2023-e821b64a4c
- FREEBSD:648A432C-A71F-11ED-86E9-D4C9EF517024
- FREEBSD:C1A8ED1C-2814-4260-82AA-9E37C83AAC93
- FREEBSD:C8EB4C40-47BD-11EE-8E38-002590C1F29C
- FREEBSD:D86BECFE-05A4-11EE-9D4A-080027EDA32C
- GLSA-202402-08
- RHSA-2023:0946
- RHSA-2023:1335
- RHSA-2023:1405
- RHSA-2023:2165
- RHSA-2023:2932
- RLSA-2023:0946
- RLSA-2023:1405
- SSA:2023-038-01
- SUSE-SU-2023:0305-1
- SUSE-SU-2023:0305-2
- SUSE-SU-2023:0306-1
- SUSE-SU-2023:0307-1
- SUSE-SU-2023:0308-1
- SUSE-SU-2023:0309-1
- SUSE-SU-2023:0310-1
- SUSE-SU-2023:0311-1
- SUSE-SU-2023:0312-1
- SUSE-SU-2023:0482-1
- SUSE-SU-2023:0684-1
- USN-5844-1
- USN-5845-1
- USN-5845-2
- USN-6564-1
Source | # ID | Name | URL |
---|---|---|---|
https://www.openssl.org/news/secadv/20230207.txt | |||
crates.io | openssl-src | https://crates.io/crates/openssl-src | |
rustsec.org | openssl-src | https://rustsec.org/packages/openssl-src.html | |
Security Advisory | GHSA-x4qr-2fvf-3mr5 | https://github.com/advisories/GHSA-x4qr-2fvf-3mr5 |
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Fixed | pkg:cargo/openssl-src | openssl-src | >= 111.25 < 300.0 | ||||
Fixed | pkg:cargo/openssl-src | openssl-src | >= 300.0.12 | ||||
Affected | pkg:cargo/openssl-src | openssl-src | < 300.0.12 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |