Type Confusion in OpenSSL - CVE-2023-0286

Vulnerability identifier: #VU71992

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2023-0286

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
OpenSSL
Oracle Linux
Gentoo Linux
Amazon Linux AMI
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)
Red Hat Enterprise Linux Workstation
Anolis OS
CentOS
Red Hat Enterprise Linux for Power, little endian
Fedora
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
SUSE Enterprise Storage
IBM AIX
IBM i
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
Oracle Solaris
FreeBSD
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Ubuntu
Slackware Linux
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Live Patching
Legacy Module
openSUSE Leap
openEuler
Junos OS Evolved
Cognos Dashboards on Cloud Pak for Data
Edgecross Basic Software for Developers ECP-BS1-W-D
Edgecross Basic Software for Windows ECP-BS1-W
MobileFirst Platform
librdkafka
Telemetry Dashboard
IBM Watson Machine Learning Accelerator
DB2 Data Management Console
EMC ECS
Liquidware
IBM MQ Appliance
Citrix Workspace App
Webex App VDI
HP-UX OpenSSL
Virtualization Management Interface
cflinuxfs3
Precision 7960 Rack
Aspera faspio Gateway
ObjectScale
Sterling Connect:Express for UNIX
Dell EMC Streaming Data Platform
IBM Aspera Shares
Secured Component Verification (SCV)
Cloud Pak for Network Automation
Avamar Data Store Gen5A
IBM MaaS360 Base Module
MaaS360 PKI Certificate Module
MaaS360 Configuration Utility
PowerStore T
Dell EMC PowerStore Family Operating System
IBM Cloud Pak for Watson AIOps
Platform Automation Toolkit
Events Operator
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
XtremIO X2
IBM Spectrum Protect Client Management Service
IBM Virtualization Engine TS7700 3948-VED
EMC Cloud Tiering Appliance
Dell Data Protection Central
Dell PowerProtect Cyber Recovery
Robotic Process Automation for Cloud Pak
OPC UA Data Collector
GT SoftGOT2000
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Observability with Instana
IBM Business Automation Workflow
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Cloud Pak for Data System
Data Lakehouse
z/Transaction Processing Facility ( z/TPF)
Service Telemetry Framework
Migration Toolkit for Virtualization
Red Hat Advanced Cluster Management for Kubernetes
Oracle VM Server for x86
IBM Watson Assistant for IBM Cloud Pak for Data
OpenShift Logging
Red Hat Migration Toolkit for Applications
IBM Rational Build Forge
IBM MQ for HPE NonStop
Oracle Communications Diameter Signaling Router
IBM Integration Bus
IBM QRadar WinCollect Agent
NetWorker
Netcool Operations Insight
Spectrum Discover
IBM MQ Operator
IBM Spectrum Conductor
PowerEdge XE8545
PowerEdge C6525
PowerEdge R7525
PowerEdge R6525
PowerEdge R7515
PowerEdge R6515
IBM MaaS360 Mobile Enterprise Gateway
IBM MaaS360 Cloud Extender Agent
IBM Cloud Transformation Advisor
IBM Tivoli Netcool System Service Monitors/Application Service Monitors
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Data Replication on Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Spectrum Control
Dell Secure Connect Gateway
Session Smart Router
IBM Safer Payments
IBM Spectrum Symphony
IBM Rational ClearQuest
IBM Rational ClearCase
IBM Power Hardware Management Console (HMC)
IBM Workload Scheduler
IBM Spectrum Protect Plus
InfoSphere Master Data Management
PowerProtect Data Manager
IBM Cloud Pak for Business Automation
Juniper Cloud Native Router
Open Enclave SDK
IBM App Connect Enterprise
IBM CICS TX Advanced
SCALANCE W1750D (USA)
SCALANCE W1750D (ROW)
SCALANCE W1750D (JP)
AFS660-C
PCULogger tool
AFR677
AFS677
AFS675
AFS665-B
AFS670
AFS670-V2
AFS650
QuTS hero
LANTIME Operating System Firmware (LTOS)
PowerEdge R660
PowerEdge R760
PowerEdge C6620
PowerEdge MX760c
PowerEdge R7625
PowerEdge R7615
PowerEdge R6625
PowerEdge R6615
PowerEdge T150
PowerEdge R250
PowerEdge T350
PowerEdge R350
PowerEdge XR11
PowerEdge R550
PowerEdge MX750c
PowerEdge C6520
PowerEdge R650
PowerEdge R750XA
PowerEdge R750
PowerEdge T550
PowerEdge R450
PowerEdge R650XS
PowerEdge R750XS
PowerEdge XR12
PowerEdge XR4510c
PowerEdge XR4520c
PowerEdge T40
Dell EMC XC Core XC7525
PowerEdge T140
PowerEdge T340
PowerEdge R240
PowerEdge R340
Dell EMC NX440
Precision 7910 Rack
PowerEdge T440
PowerEdge M640
PowerEdge FC640
PowerEdge C6420
PowerEdge T640
PowerEdge R940XA
PowerEdge R840
PowerEdge R740XD2
PowerEdge XR2
Dell EMC XC Core XC750xa
PowerEdge R440
PowerEdge R540
PowerEdge R940
PowerEdge R640
PowerEdge R740XD
PowerEdge R740
Dell EMC XC Core XC740xd System
Dell EMC XC Core XC6520
PowerEdge M640 (for PE VRTX)
Dell EMC XC Core XC750
Dell EMC XC Core XC650
Dell EMC XC Core XC450
Dell EMC XC Core XCXR2
Dell EMC XC Core XC940 System
Dell EMC XC Core XC740xd2
Dell EMC XC Core XC640 System
Dell EMC XC Core 6420 System
Dell EMC Storage NX3340
Dell EMC Storage NX3240
DSS 8440
PowerEdge C4140
PowerEdge MX840C
PowerEdge MX740C
Precision 7920 Rack
SIMATIC MV560 U
SIMATIC MV560 X
SIMATIC MV550 H
SIMATIC MV540 S
SIMATIC MV540 H
SIMATIC MV550 S
Virtualization Engine TS7700 3957-VEC
Virtualization Engine TS7700 3957-VED
PowerScale OneFS
Junos cRPD
PCU400
SCALANCE XR528-6M
SCALANCE XR552-12M
SCALANCE XR526-8C
SCALANCE XR524-8C
SCALANCE XM416-4C
SCALANCE XM408-8C
SCALANCE XM408-4C
Dell EMC VxRail Appliance
Gaia
API Manager
IBM Integrated Analytics System
IBM QRadar Network Packet Capture
API Gateway
JBoss Core Services
IBM VIOS
Node Health Check Operator
Self Node Remediation Operator
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift Service Mesh
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
Node Maintenance Operator
VMware Tanzu Operations Manager
python-cryptography
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
grpc
Migration Toolkit for Containers
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
IBM Edge Application Manager
VMware Horizon Client
Dell EMC Container Storage Modules
IBM DataPower Gateway
IBM Watson Explorer Foundational Components
IBM Watson Explorer Deep Analytics Edition Foundational Components
Python
QNAP QTS
Splunk Universal Forwarder
JBoss Web Server
Node.js
IBM Qradar SIEM
Cloud Pak for Security (CP4S)
TeleControl Server Basic
Event Streams
NetWorker Management Console
Barracuda CloudGen WAN
Splunk Security Orchestration, Automation and Response (SOAR)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libssl1.0.0 (Ubuntu package)
openssl-1_1-livepatches
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-openssl-chil (Red Hat package)
openssl (Red Hat package)
openssl1-doc
libopenssl1-devel
libopenssl1_0_0
libopenssl1_0_0-32bit
openssl1
openssl-doc
libopenssl1_0_0-debuginfo
openssl
openssl-debugsource
libopenssl1_0_0-hmac
openssl-debuginfo
libopenssl1_0_0-debuginfo-32bit
libopenssl1_0_0-hmac-32bit
libopenssl-devel
openssl-perl
openssl-static
openssl-devel
openssl-libs
compat-openssl10
compat-openssl10 (Red Hat package)
libopenssl-1_0_0-devel-32bit
libopenssl-1_0_0-devel
openssl-1_0_0-doc
openssl-1_0_0-debugsource
openssl-1_0_0-debuginfo
openssl-1_0_0
libopenssl10
libopenssl10-debuginfo
libopenssl1_0_0-steam-debuginfo
openssl-1_0_0-cavs
libopenssl1_0_0-steam
openssl-1_0_0-cavs-debuginfo
libopenssl1_0_0-steam-32bit-debuginfo
libopenssl1_0_0-steam-32bit
libopenssl1_0_0-32bit-debuginfo
libopenssl1_1
libopenssl1_1-debuginfo
libopenssl1_1-hmac-32bit
libopenssl1_1-hmac
libopenssl1_1-32bit-debuginfo
libopenssl1_1-32bit
libopenssl-1_1-devel-32bit
openssl-1_1-debuginfo
openssl-1_1-debugsource
openssl-1_1
libopenssl-1_1-devel
libopenssl1_1-debuginfo-32bit
openssl-1_1-doc
openssl-help
openssl11
compat-openssl11 (Red Hat package)
openssl-solibs
libssl1.1 (Ubuntu package)
openssl (Debian package)
jws5-tomcat-native (Red Hat package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
openssl-3-doc
libopenssl3-32bit-debuginfo
libopenssl3-32bit
libopenssl-3-devel-32bit
openssl-3-debugsource
openssl-3-debuginfo
openssl-3
libopenssl3-debuginfo
libopenssl3
libopenssl-3-devel
libssl3 (Ubuntu package)
openssl3
dev-libs/openssl
redhat-release-virtualization-host (Red Hat package)
npm
v8-devel
jbcs-httpd24-curl (Red Hat package)
libnode72 (Ubuntu package)
libnode-dev (Ubuntu package)
nodejs (Ubuntu package)
nodejs
nodejs-debugsource
nodejs-full-i18n
nodejs-libs
nodejs-debuginfo
nodejs-devel
nodejs-docs
shim-debugsource
shim-debuginfo
shim
edk2 (Ubuntu package)
edk2-aarch64
edk2-help
edk2-ovmf
edk2
python3-edk2-devel
edk2-devel
edk2-debuginfo
edk2-debugsource
edk2 (Red Hat package)
Zimbra Collaboration
PeopleSoft Enterprise PeopleTools
IBM API Connect
IBM Security Guardium
Cisco Jabber
Cisco Webex Meetings
Orion Platform
IBM Security Verify Access
IBM DS8000 Hardware Management Console
IBM Cloud Pak System
IBM MaaS360 VPN Module
EMC ViPR SRM
RSA Authentication Manager
IBM InfoSphere Information Server

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error related to X.400 address processing inside an X.509 GeneralName. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and perform a denial of service (DoS) attack or read memory contents.

In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Install updates from vendor's website.

• https://www.openssl.org/news/secadv/20230207.txt