Invalid pointer dereference in d2i_PKCS7 functions
Summary
Invalid pointer dereference in d2i_PKCS7 functions
Original description
The description as published by the source.
An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
The result of the dereference is an application crash which could
lead to a denial of service attack. The TLS implementation in OpenSSL
does not call this function however third party applications might
call these functions on untrusted data.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-0216 openssl Fixed in: 3.0.8-r0
- Debian DEBIAN-CVE-2023-0216 openssl Fixed in: 3.0.8-1
References
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory openssl.org
- advisory github.com
- patch git.openssl.org
- web psirt.global.sonicwall.com
- web rustsec.org