⚡ TL;DR | Go Straight to the OpenSSL Audit Report
On the 7th of February, the OpenSSL Project released a new update to address several vulnerabilities. One of these is a high-severity type confusion vulnerability that, if successfully exploited, could allow an attacker to read memory contents or enact a denial of service. This could in turn cause the program to behave in unintended ways. In some cases, this could lead to system crashes and code execution.
Update Vulnerable OpenSSL Installations
OpenSSL’s security advisory addresses 8 security issues. You can find a summary below or check out the advisory for full details. Of the 8, only the type confusion vulnerability CVE-2023-0286 is given a high-severity rating. The others all rank as moderate.
Not all of these issues affect every version of OpenSSL, but in general versions 3.0 (up to 3.0.7), 1.1.1, and 1.0.2 are at risk. To protect yourself against these vulnerabilities, you are advised to upgrade any OpenSSL installations to the patched versions 3.0.8, 1.1.1t, and 1.0.2zg.
| CVE | Description | Severity | Affected Versions | Patched versions |
| CVE-2023-0286 | type confusion vulnerability relating to X.400 address processing | High | 3.0, 1.1.1, 1.0.2 | 3.0.8, 1.1.1t, 1.0.2zg |
| CVE-2022-4304 | Timing Oracle in RSA Decryption | Moderate | 3.0, 1.1.1, 1.0.2 | 3.0.8, 1.1.1t, 1.0.2zg |
| CVE-2022-4203 | X.509 Name Constraints Read Buffer Overflow | Moderate | 3.0.0 to 3.0.7 | 3.0.8 |
| CVE-2023-0215 | Use-after-free following BIO_new_NDEF | Moderate | 3.0, 1.1.1, 1.0.2 | 3.0.8, 1.1.1t, 1.0.2zg |
| CVE-2022-4450 | Double free after calling PEM_read_bio_ex | Moderate | 3.0, 1.1.1 | 3.0.8, 1.1.1t |
| CVE-2023-0216 | Invalid pointer dereference in d2i_PKCS7 functions | Moderate | 3.0.0 to 3.0.7 | 3.0.8 |
| CVE-2023-0217 | NULL dereference validating DSA public key | Moderate | 3.0.0 to 3.0.7 | 3.0.8 |
| CVE-2023-0401 | NULL dereference during PKCS7 data verification | Moderate | 3.0.0 to 3.0.7 | 3.0.8 |
OpenSSL Vulnerability CVE-2023-0286
CVE-2023-0286 is the only issue that received a high severity rating. It is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. In most cases, when attacking, a malicious actor will have to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one, then the other input must already contain an X.400 address as a CRL Distribution point. However, this is uncommon. If the attack succeeds, it could allow an attacker to read memory contents or enact denial-of-service.
Audit your OpenSSL Installations
Our technical team has put together a report, that will give you an overview of all OpenSSL instances in your network, as well as relevant information including version numbers. This way you have an actionable overview of any installations that still need to be upgraded.
