NULL pointer dereference in OpenSSL - CVE-2023-0401

Vulnerability identifier: #VU71999

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-0401

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error during PKCS7 data verification. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

OpenSSL
IBM Business Automation Workflow
IBM Observability with Instana
IBM Rational Build Forge
IBM MQ
IBM Integration Bus
Tenable Nessus
IBM QRadar WinCollect Agent
IBM Spectrum Copy Data Management
IBM Spectrum Conductor
IBM MaaS360 Mobile Enterprise Gateway
IBM MaaS360 Cloud Extender Agent
IBM Tivoli Netcool System Service Monitors/Application Service Monitors
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Spectrum Control
App Connect Enterprise Certified Container
IBM Spectrum Symphony
IBM Rational ClearQuest
IBM Spectrum Protect Plus
Juniper Cloud Native Router
PCULogger tool
Junos cRPD
PCU400
SCALANCE XC216-4C
SCALANCE XF204
SCALANCE XC224-4C G EEC
SCALANCE XC224-4C G
SCALANCE XC224
SCALANCE XC216EEC
SCALANCE XC216-4C G EEC
SCALANCE XC216-4C G
SCALANCE XF204 DNA
SCALANCE XC216-3G PoE
SCALANCE XC208G PoE
SCALANCE XC208G EEC
SCALANCE XC208G
SCALANCE XC208EEC
SCALANCE XC208
SCALANCE XC206-2SFP G EEC
SCALANCE XC206-2SFP G
SCALANCE XF204-2BA
SIPLUS NET SCALANCE XC216-4C
SIPLUS NET SCALANCE XC208
SIPLUS NET SCALANCE XC206-2SFP
SCALANCE XF204-2BA DNA
SCALANCE XP208
SCALANCE XC216
SCALANCE XP208EEC
SCALANCE XP208PoE EEC
SIPLUS NET SCALANCE XC206-2
SCALANCE XR328-4C WG
SCALANCE XR326-2C PoE WG
SCALANCE XR324WG
SCALANCE XP216POE EEC
SCALANCE XP216EEC
SCALANCE XP216
SCALANCE XC206-2SFP
SCALANCE XC206-2SFP EEC
SCALANCE XB205-3
SCALANCE XB205-3LD
SCALANCE XB208
SCALANCE XB213-3
SCALANCE XB213-3LD
SCALANCE XB216
SCALANCE XC206-2
SCALANCE XC206-2G PoE
SCALANCE XC206-2G PoE EEC
Amazon Linux AMI
Gentoo Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
IBM AIX
Fedora
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Oracle Solaris
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
openEuler
Junos OS Evolved
MobileFirst Platform
librdkafka
Dell Hybrid Client
Oracle Business Intelligence Enterprise Edition
cflinuxfs3
Aspera faspio Gateway
Dell EMC Streaming Data Platform
IBM MaaS360 Base Module
MaaS360 PKI Certificate Module
MaaS360 Configuration Utility
Platform Automation Toolkit
IBM Spectrum Protect Client Management Service
Cognos Transformer
Dell Data Protection Central
API Manager
IBM Integrated Analytics System
API Gateway
IBM VIOS
Nessus Network Monitor
Red Hat OpenShift Container Platform
Tenable.sc
Barracuda CloudGen WAN
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libssl1.1 (Ubuntu package)
openssl (Red Hat package)
openssl-3-debugsource
libopenssl-3-devel
libopenssl3
libopenssl3-debuginfo
openssl-3
openssl-3-doc
libopenssl3-32bit-debuginfo
libopenssl3-32bit
libopenssl-3-devel-32bit
openssl-3-debuginfo
libssl3 (Ubuntu package)
openssl
openssl3
dev-libs/openssl
libnode-dev (Ubuntu package)
libnode72 (Ubuntu package)
nodejs (Ubuntu package)
edk2
python3-edk2-devel
edk2-debugsource
edk2-debuginfo
edk2-devel
edk2-aarch64
edk2-help
edk2-ovmf
Nessus Agent
IBM App Connect Enterprise
Node.js
IBM MaaS360 VPN Module

Install updates from vendor's website.

OpenSSL - update to 3.0.8
PCULogger tool - update to 1.2.0
PCU400 - addressed in versions 6.6.0, 9.4.2
API Manager - update to February 2023
API Gateway - update to February 2023
librdkafka - update to 2.1.0
Nessus Network Monitor - update to 6.2.1
Tenable.sc - update to 6.0.0 Patch SC-202303.1-6
IBM Rational Build Forge - update to 8.0.0.24
Barracuda CloudGen WAN - update to 8.3.1 1093
IBM MQ - addressed in versions 9.0.0.17, 9.2.0.11, 9.3.0.5
Tenable Nessus - addressed in versions 10.4.3, 10.5.0
IBM QRadar WinCollect Agent - update to 10.1.3
Nessus Agent - update to 10.3.2
Node.js - addressed in versions 14.21.3, 16.19.1, 18.14.1, 19.6.1
Junos OS Evolved - addressed in versions 22.1R3-S5-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-S1-EVO, 23.2R2-EVO, 23.4R1-EVO
cflinuxfs3 - update to 0.351.0
IBM Integrated Analytics System - update to 1.0.30.0
libssl1.1 (Ubuntu package) - addressed in versions 1.1.1f-1ubuntu2.17, 1.1.1-1ubuntu2.1~18.04.21
Aspera faspio Gateway - update to 1.3.2
Dell EMC Streaming Data Platform - update to 1.7.0
IBM Spectrum Copy Data Management - update to 2.2.20.0
IBM Spectrum Conductor - update to 2.5.1 FP2
openssl (Red Hat package) - addressed in versions 3.0.1-46.el9_0, 3.0.1-47.el9_1
openssl-3-debugsource - update to 3.0.1-150400.4.17.1
libopenssl-3-devel - update to 3.0.1-150400.4.17.1
libopenssl3 - update to 3.0.1-150400.4.17.1
libopenssl3-debuginfo - update to 3.0.1-150400.4.17.1
openssl-3 - update to 3.0.1-150400.4.17.1
openssl-3-doc - update to 3.0.1-150400.4.17.1
libopenssl3-32bit-debuginfo - update to 3.0.1-150400.4.17.1
libopenssl3-32bit - update to 3.0.1-150400.4.17.1
libopenssl-3-devel-32bit - update to 3.0.1-150400.4.17.1
openssl-3-debuginfo - update to 3.0.1-150400.4.17.1
libssl3 (Ubuntu package) - addressed in versions 3.0.2-0ubuntu1.8, 3.0.5-2ubuntu2.1
openssl - update to 3.0.5-1
openssl3 - update to 3.0.7-5.el8.1
openssl - addressed in versions 3.0.8-1.fc36, 3.0.8-1.fc37
dev-libs/openssl - update to 3.0.10
IBM MaaS360 Base Module - update to 3.000.100
MaaS360 PKI Certificate Module - update to 3.000.100
MaaS360 Configuration Utility - update to 3.000.100
IBM MaaS360 VPN Module - update to 3.000.100
IBM MaaS360 Mobile Enterprise Gateway - update to 3.000.100
IBM MaaS360 Cloud Extender Agent - update to 3.000.100.069
IBM Tivoli Netcool System Service Monitors/Application Service Monitors - update to 4.0.1 SP11
Platform Automation Toolkit - addressed in versions 4.4.31, 5.0.24, 5.1.0
SCALANCE XC216-4C - update to 4.5
SCALANCE XF204 - update to 4.5
SCALANCE XC224-4C G EEC - update to 4.5
SCALANCE XC224-4C G - update to 4.5
SCALANCE XC224 - update to 4.5
SCALANCE XC216EEC - update to 4.5
SCALANCE XC216-4C G EEC - update to 4.5
SCALANCE XC216-4C G - update to 4.5
SCALANCE XF204 DNA - update to 4.5
SCALANCE XC216-3G PoE - update to 4.5
SCALANCE XC208G PoE - update to 4.5
SCALANCE XC208G EEC - update to 4.5
SCALANCE XC208G - update to 4.5
SCALANCE XC208EEC - update to 4.5
SCALANCE XC208 - update to 4.5
SCALANCE XC206-2SFP G EEC - update to 4.5
SCALANCE XC206-2SFP G - update to 4.5
SCALANCE XF204-2BA - update to 4.5
SIPLUS NET SCALANCE XC216-4C - update to 4.5
SIPLUS NET SCALANCE XC208 - update to 4.5
SIPLUS NET SCALANCE XC206-2SFP - update to 4.5
SCALANCE XF204-2BA DNA - update to 4.5
SCALANCE XP208 - update to 4.5
SCALANCE XC216 - update to 4.5
SCALANCE XP208EEC - update to 4.5
SCALANCE XP208PoE EEC - update to 4.5
SIPLUS NET SCALANCE XC206-2 - update to 4.5
SCALANCE XR328-4C WG - update to 4.5
SCALANCE XR326-2C PoE WG - update to 4.5
SCALANCE XR324WG - update to 4.5
SCALANCE XP216POE EEC - update to 4.5
SCALANCE XP216EEC - update to 4.5
SCALANCE XP216 - update to 4.5
SCALANCE XC206-2SFP - update to 4.5
SCALANCE XC206-2SFP EEC - update to 4.5
SCALANCE XB205-3 - update to 4.5
SCALANCE XB205-3LD - update to 4.5
SCALANCE XB208 - update to 4.5
SCALANCE XB213-3 - update to 4.5
SCALANCE XB213-3LD - update to 4.5
SCALANCE XB216 - update to 4.5
SCALANCE XC206-2 - update to 4.5
SCALANCE XC206-2G PoE - update to 4.5
SCALANCE XC206-2G PoE EEC - update to 4.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.5
Red Hat OpenShift Container Platform - update to 4.13.0
IBM Spectrum Control - update to 5.4.10.1
App Connect Enterprise Certified Container - update to 7.0.0
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
IBM Spectrum Protect Client Management Service - update to 8.1.17.2
IBM Rational ClearQuest - addressed in versions 9.0.2.8, 9.1.0.5, 10.0.3
IBM Spectrum Protect Plus - update to 10.1.14
Cognos Transformer - update to 11.1.7 Fix Pack 8
libnode-dev (Ubuntu package) - update to 12.22.9~dfsg-1ubuntu3.3
libnode72 (Ubuntu package) - update to 12.22.9~dfsg-1ubuntu3.3
nodejs (Ubuntu package) - update to 12.22.9~dfsg-1ubuntu3.3
Dell Data Protection Central - update to 19.11.0-2
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1
edk2 - update to 202002-15
python3-edk2-devel - update to 202002-15
edk2-debugsource - update to 202002-15
edk2-debuginfo - update to 202002-15
edk2-devel - update to 202002-15
edk2-aarch64 - update to 202002-15
edk2-help - update to 202002-15
edk2-ovmf - update to 202002-15

• https://www.openssl.org/news/secadv/20230207.txt

• Multiple vulnerabilities in OpenSSL
• Ubuntu update for openssl
• SUSE update for openssl-3
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• Node.js update for OpenSSL
• Red Hat Enterprise Linux 9 update for openssl
• Multiple vulnerabilities in IBM Business Automation Workflow Configuration Editor
• Multiple vulnerabilities in Tenable.sc
• Multiple vulnerabilities in Tenable Nessus
• Barracuda CloudGen WAN update for OpenSSL
• IBM Aspera faspio Gateway update for OpenSSL
• Multiple vulnerabilities in Nessus Agent 10.x
• Multiple vulnerabilities in QRadar WinCollect Agent
• Red Hat Enterprise Linux 9.0 Extended Update Support update for openssl
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus
• Multiple vulnerabilities in IBM Spectrum Protect Backup-Archive Client
• IBM AIX and VIOS update for OpenSSL
• Multiple vulnerabilities in API Gateway and API Manager
• Multiple vulnerabilities in librdkafka
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in IBM MobileFirst Foundation
• Multiple vulnerabilities in IBM MQ
• Multiple vulnerabilities in Nessus Network Monitor
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• VMware Tanzu Platform Automation Toolkit update for OpenSSL
• Multiple vulnerabilities in IBM MaaS360 Cloud Extender Agent, Mobile Enterprise Gateway, Configuration Utility, VPN, Certificate and Base Module
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Tivoli Netcool System Service Monitors/Application Service Monitors
• Multiple vulnerabilities in Dell Streaming Data Platform
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Dell Hybrid Client
• Fedora 37 update for openssl
• Fedora 36 update for openssl
• Fedora EPEL 8 update for openssl3
• Multiple vulnerabilities in IBM Rational ClearQuest
• Multiple vulnerabilities in IBM Spectrum Conductor
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Observability with Instana (Self-hosted on Docker)
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in Siemens SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family
• Ubuntu update for nodejs
• Gentoo update for OpenSSL
• Multiple vulnerabilities in IBM Cognos Transformer
• openEuler update for edk2
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Junos OS Evolved update for OpenSSL
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Amazon Linux AMI update for openssl
• Multiple vulnerabilities in IBM Integrated Analytics System
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Hitachi Energy PCU400 and PCULogger