Published: 08/02/2023 Updated: 04/02/2024

CVSS v3 Base Score: 7.4 | Impact Score: 5.2 | Exploitability Score: 2.2

VMScore: 0

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an malicious user to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the malicious user to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl
stormshield stormshield network security
stormshield stormshield management center

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit, which may result in incomplete encryption, side channel attacks, denial of service or information disclosure Additional details can be found in the upstream advisories at wwwopensslorg/news/secadv/20220705txt and wwwopensslorg/news/secadv ...

A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover a ciphertext across a network in a Bleichenbacher style attack To achieve a successful decryption, an attacker would have to be able to send a very large number of trial messages for decryption This issue affects all RSA padding m ...

DescriptionA type confusion vulnerability was found in OpenSSL when OpenSSL X400 addresses processing inside an X509 GeneralName When CRL checking is enabled (for example, the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory ...

A null pointer dereference flaw was found in openssl A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service The highest threat from this vulnerability is to system availability (CVE-2020-1971) Calls to EVP_CipherUpdate, EVP_En ...

Synopsis Moderate: OpenShift Container Platform 41056 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 41056 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Pla ...

Synopsis Important: edk2 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for edk2 is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has rated this ...

Synopsis Moderate: Red Hat Advanced Cluster Management 265 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 265 GeneralAvailability release images, which fix bugs and security updates container imagesRed Hat Product Security has rated this update as having a ...

Synopsis Important: edk2 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for edk2 is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a securi ...

Synopsis Important: Red Hat JBoss Web Server 573 release and security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat JBoss Web Server 573 on Red Hat Enterprise Linux vers ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2451 SP2 security update Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services Apache HTTP Server 2451 Service Pack 2 is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Sco ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2451 SP2 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat JBoss Core Services Apache HTTP Server 2 ...

Synopsis Moderate: Logging Subsystem for Red Hat OpenShift - 559 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Logging Subsystem for Red Hat OpenShift - 559Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Important: edk2 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for edk2 is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security has rated this ...

Synopsis Moderate: Multicluster Engine for Kubernetes 216 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Multicluster Engine for Kubernetes 216 General Availability release images, which fix bugs and security updates container imagesRed Hat Product Security has rated this update as having a security impact ...

Synopsis Important: Red Hat OpenShift Data Foundation 4117 Bug Fix and security update Type/Severity Security Advisory: Important Topic Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4117 on Red Hat Enterprise Linux 8 from Red Hat Container RegistryRed Hat Product Security has rated this upda ...

Synopsis Moderate: Release of OpenShift Serverless 1290 Type/Severity Security Advisory: Moderate Topic OpenShift Serverless version 1290 contains a moderate security impactThe References section contains CVE links providing detailed severity ratingsfor each vulnerability Ratings are based on a Common Vulnerability ScoringSystem (CVSS) ...

Synopsis Important: Red Hat JBoss Web Server 573 release and security update Type/Severity Security Advisory: Important Topic Red Hat JBoss Web Server 573 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows ServerRed Hat Product Security has rated this release a ...

Synopsis Important: openssl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for openssl is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a ...

Synopsis Moderate: Migration Toolkit for Containers (MTC) 179 security and bug fix update Type/Severity Security Advisory: Moderate Topic The Migration Toolkit for Containers (MTC) 179 is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base ...

Synopsis Important: openssl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for openssl is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat Product Security has rate ...

Synopsis Moderate: Red Hat Advanced Cluster Management 258 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 258 GeneralAvailability release images, which fix bugs and security updates container imagesRed Hat Product Security has rated this update as having a ...

Synopsis Moderate: OpenShift Container Platform 4959 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4959 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...

Synopsis Moderate: Multicluster Engine for Kubernetes 208 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Multicluster Engine for Kubernetes 208 General Availability release images, which fix bugs and security updates container imagesRed Hat Product Security has rated this update as having a security impact ...

Synopsis Moderate: OpenShift Container Platform 41146 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 41146 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Plat ...

Synopsis Important: OpenShift Virtualization 4125 security and bug fix update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4125 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security imp ...

Synopsis Important: openssl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for openssl is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has rate ...

Synopsis Moderate: OpenShift Container Platform 41134 bug fix and security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 41134 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift C ...

概述 Important: openssl security and bug fix update 类型/严重性 Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems 标题 An update for openssl is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Sec ...

Synopsis Important: openssl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for openssl is now available for Red Hat Enterprise Linux 81 Update Services for SAP SolutionsRed Hat Product Securit ...

Synopsis Critical: Multicluster Engine for Kubernetes 223 security updates and bug fixes Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 223 General Availability release images, which fix bugs and security updates container imagesRed Hat Product Security has rated this update as having a security impact ...

Synopsis Moderate: Red Hat OpenShift Service Mesh 227 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Service Mesh 227Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is ...

Synopsis Important: Service Telemetry Framework 152 security update Type/Severity Security Advisory: Important Topic An update is now available for Service Telemetry Framework 152Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a ...

Synopsis Important: Self Node Remediation Operator 051 security update Type/Severity Security Advisory: Important Topic This is an updated version of the Self Node Remediation Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Commo ...

Synopsis Important: Node Health Check Operator 041 Type/Severity Security Advisory: Important Topic This is an updated version of the Node Health Check Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...

Synopsis Important: Node Maintenance Operator 501 security update Type/Severity Security Advisory: Important Topic This is an updated version of the Node Maintenance Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerab ...

Synopsis Important: edk2 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for edk2 is now available for Red Hat Enterprise Linux 82 Advanced Update Support, Red Hat Enterprise Linux 82 Telecommu ...

Synopsis Critical: Multicluster Engine for Kubernetes 20 hotfix security update for console Type/Severity Security Advisory: Critical Topic Red Hat Multicluster Engine Hotfix Security Update for ConsoleRed Hat Product Security has rated this update as having a security impactof Critical A Common Vulnerability Scoring System (CVSS) base scor ...

Synopsis Critical: Red Hat Advanced Cluster Management 273 security fixes and bug fixes Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes 273 GeneralAvailability release images, which fix bugs and security updates container imagesRed Hat Product Security has rated this update as having a s ...

Synopsis Important: openssl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for openssl is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a ...

Synopsis Important: Migration Toolkit for Applications security and bug fix update Type/Severity Security Advisory: Important Topic Migration Toolkit for Applications 610 releaseRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a deta ...

Synopsis Important: edk2 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for edk2 is now available for Red Hat Enterprise Linux 84 Advanced Mission Critical Update Support, Red Hat Enterprise Li ...

Synopsis Moderate: OpenShift Container Platform 41216 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 41216 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Pla ...

Synopsis Important: openssl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for openssl is now available for Red Hat Enterprise Linux 82 Advanced Update SupportRed Hat Product Security has rate ...

Synopsis Important: openssl security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for openssl is now available for Red Hat Enterprise Linux 6 Extended Lifecycle SupportRed Hat Product Security has rat ...

Synopsis Moderate: Red Hat OpenShift Data Foundation 4122 Bug Fix and security update Type/Severity Security Advisory: Moderate Topic Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4122 on Red Hat Enterprise Linux 8 from Red Hat Container RegistryRed Hat Product Security has rated this update ...

Synopsis Important: Migration Toolkit for Containers (MTC) 1710 security and bug fix update Type/Severity Security Advisory: Important Topic The Migration Toolkit for Containers (MTC) 1710 is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ...

Synopsis Moderate: Secondary Scheduler Operator for Red Hat OpenShift 111 security update Type/Severity Security Advisory: Moderate Topic Secondary Scheduler Operator for Red Hat OpenShift 111Red Hat Product Security has rated this update as having a security impact ofModerate A Common Vulnerability Scoring System (CVSS) base score, whic ...

Synopsis Important: OpenShift Container Platform 4132 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4132 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift C ...

Multiple vulnerabilities have been found in Cosminexus HTTP Server CVE-2022-4304, CVE-2022-4450, CVE-2023-0286 Affected products and versions are listed below Please upgrade your version to the appropriate version ...

Menu Log in ...

PAN-SA-2023-0001 Impact of OpenSSL Vulnerabilities Disclosed Feb 7, 2023 ...

PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS ...

Critical Infrastructure Sectors: Critical Manufacturing

Critical Infrastructure Sectors: Energy, Transportation Systems, Water and Wastewater Systems

Critical Infrastructure Sectors: Critical Manufacturing

API for trusted content

trust-api API server for trusted content (TC) Running on OpenShift See this repository Running locally Running: cargo run -- run -p 8080 Usage: curl --json '["pkg:maven/orgquarkus/quarkus@12"]' localhost:8080/api/package Testing with guac Start guac: podman run -p 8080:80

Guac Rust library This library provides toolkit for working with Guac from Rust It can be used for querying data using GraphQL API and ingesting data with collectors It also contains a command-line interface (CLI) that exposes query API and collectors Prerequisites In order to use this library and CLI, you need to have a running Guac instance (and preferably ingest some dat

Patched Fluentd Docker Image Overview This Docker image is a patched version of Fluentd that addresses vulnerabilities linked to OpenSSL The primary purpose of this patched image is to provide an enhanced security profile for production deployments Files Dockerfile: Contains the build steps for creating the patched Fluentd Docker image OpenSSL Vulnerabilities Addressed Thi

CWE-843 https://www.openssl.org/news/secadv/20230207.txt https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig https://security.gentoo.org/glsa/202402-08 https://www.debian.org/security/2023/dsa-5343 https://nvd.nist.gov https://github.com/xkcd-2347/trust-api https://www.cisa.gov/news-events/ics-advisories/icsa-24-004-02

Get Started

CVE-2023-0286

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect