Resource management error in OpenSSL - CVE-2023-2650

Vulnerability identifier: #VU76651

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2023-2650

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
OpenSSL
CC-Link IE TSN NZ2MHG-TSNT4
CC-Link IE TSN NZ2MHG-TSNT8F2
SCALANCE XF204
SCALANCE XF204 DNA
SCALANCE XF204-2BA
SCALANCE XF204-2BA DNA
SCALANCE XP208
SCALANCE XP208EEC
SCALANCE XP208PoE EEC
SCALANCE XP216
SCALANCE XP216EEC
SCALANCE XP216POE EEC
SCALANCE XR324WG
SCALANCE XR326-2C PoE WG
SCALANCE XR328-4C WG
SIPLUS NET SCALANCE XC206-2
SIPLUS NET SCALANCE XC206-2SFP
SIPLUS NET SCALANCE XC208
SIPLUS NET SCALANCE XC216-4C
SCALANCE XC208G PoE
SCALANCE XC224-4C G
SCALANCE XB205-3
SCALANCE XB205-3LD
SCALANCE XB208
SCALANCE XB213-3
SCALANCE XB213-3LD
SCALANCE XB216
SCALANCE XC206-2
SCALANCE XC206-2G PoE
SCALANCE XC206-2G PoE EEC
SCALANCE XC206-2SFP
SCALANCE XC206-2SFP EEC
SCALANCE XC206-2SFP G
SCALANCE XC206-2SFP G EEC
SCALANCE XC208EEC
SCALANCE XC224-4C G EEC
SCALANCE XC224
SCALANCE XC216EEC
SCALANCE XC216-4C G EEC
SCALANCE XC216-4C G
SCALANCE XC216-4C
SCALANCE XC216-3G PoE
SCALANCE XC216
SCALANCE XC208G EEC
SCALANCE XC208G
SCALANCE XC208
Dell EMC VxRail Appliance
Oracle Linux
Gentoo Linux
Amazon Linux AMI
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
F5OS
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
IBM i
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE
Oracle Solaris
Legacy Module
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
Slackware Linux
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
openEuler
Cisco NX-OS
Cognos Dashboards on Cloud Pak for Data
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
Telemetry Dashboard
Liquidware
HPE OneView
Citrix Workspace App
Webex App VDI
ObjectScale
IBM Aspera Shares
Secured Component Verification (SCV)
IBM Planning Analytics Workspace
EMC ECS
Enterprise SONiC
IBM Cloud Pak for Watson AIOps
Platform Automation Toolkit
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Events Operator
Storage Ceph
MobileFirst Platform
Storage Protect Client
Storage Protect for Virtual Environments: Data Protection for VMware
Index Engines CyberSense
IBM MQ Appliance
IBM Workload Automation
Cognos Transformer
EMC Cloud Tiering Appliance
Dell PowerProtect Cyber Recovery
Storage Insights - Data Collector
Isolation Segment
VMware Tanzu Application Service for VMs
Data Lakehouse
cert-manager Operator for Red Hat OpenShift
IBM Cloud Pak for Data System
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Rational Build Forge
Oracle HTTP Server
NetWorker
Sensor Proxy
IBM Spectrum Conductor
IBM MaaS360 Mobile Enterprise Gateway
IBM Tivoli Netcool System Service Monitors/Application Service Monitors
IBM Spectrum Control
Session Smart Router
IBM Safer Payments
IBM Spectrum Symphony
IBM MQ for HPE NonStop
IBM MQ
IBM Rational ClearCase
IBM Rational ClearQuest
InfoSphere Master Data Management
PowerProtect Data Manager
Juniper Cloud Native Router
BIG-IP
LANTIME Operating System Firmware (LTOS)
Dell G15 5511
Alienware m15 R6
XPS 8960
FOS Firmware
Junos cRPD
OpenShift sandboxed containers
OpenShift Data Foundation (formerly OpenShift Container Storage)
VMware Tanzu Operations Manager
QRadar Suite
Dell EMC NetWorker vProxy
Red Hat OpenShift Container Platform
Traffix SDC
JD Edwards EnterpriseOne Tools
IBM Watson Explorer Foundational Components
IBM Watson Explorer Deep Analytics Edition Foundational Components
VMware Horizon Client
IBM DataPower Gateway
JBoss Web Server
MySQL Server
MySQL Enterprise Monitor
IBM InfoSphere Information Server
Oracle Essbase
SecurityCenter
BIG-IQ Centralized Management
IBM Security Verify Access
MySQL Workbench
IBM App Connect Enterprise
Nessus Agent
Event Streams
Cisco Jabber
Cisco Webex Meetings
openssl (Ubuntu package)
libssl1.0.0 (Ubuntu package)
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
libopenssl0_9_8
libopenssl0_9_8-hmac
openssl
libopenssl0_9_8-32bit
openssl-doc
libopenssl0_9_8-hmac-32bit
libopenssl0_9_8-debuginfo-32bit
compat-openssl098-debugsource
libopenssl0_9_8-debuginfo
jbcs-httpd24-openssl-chil (Red Hat package)
libopenssl1_0_0-32bit
libopenssl1-devel
openssl1-doc
libopenssl1_0_0
openssl1
libopenssl1_0_0-hmac
openssl-debuginfo
libopenssl1_0_0-debuginfo
openssl-debugsource
libopenssl1_0_0-debuginfo-32bit
libopenssl-devel
libopenssl1_0_0-hmac-32bit
libopenssl-1_0_0-devel
libopenssl-1_0_0-devel-32bit
openssl-1_0_0-doc
openssl-1_0_0-debuginfo
openssl-1_0_0
openssl-1_0_0-debugsource
libopenssl1_0_0-steam-debuginfo
libopenssl10
libopenssl10-debuginfo
libopenssl1_0_0-steam
openssl-1_0_0-cavs
openssl-1_0_0-cavs-debuginfo
libopenssl1_0_0-32bit-debuginfo
libopenssl1_0_0-steam-32bit-debuginfo
libopenssl1_0_0-steam-32bit
libopenssl1_1-hmac
openssl-1_1-debugsource
libopenssl1_1
openssl-1_1-debuginfo
libopenssl1_1-hmac-32bit
libopenssl1_1-32bit
libopenssl-1_1-devel-32bit
libopenssl1_1-32bit-debuginfo
libopenssl-1_1-devel
libopenssl1_1-debuginfo
openssl-1_1
libopenssl1_1-debuginfo-32bit
openssl-1_1-doc
openssl-devel
openssl-libs
openssl-help
libopenssl-1_1-devel-64bit
libopenssl1_1-64bit
libopenssl1_1-hmac-64bit
libopenssl1_1-64bit-debuginfo
openssl-perl
openssl-solibs
libssl1.1 (Ubuntu package)
openssl (Debian package)
jws5-tomcat-native (Red Hat package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
libssl3 (Ubuntu package)
openssl (Red Hat package)
libopenssl3-32bit-debuginfo
libopenssl3-32bit
openssl-3-debugsource
openssl-3
openssl-3-debuginfo
libopenssl3
libopenssl3-debuginfo
libopenssl-3-devel
libopenssl-3-devel-32bit
openssl-3-doc
libopenssl3-64bit-debuginfo
libopenssl-3-devel-64bit
libopenssl3-64bit
dev-libs/openssl
mysql-server-8.0 (Ubuntu package)
jbcs-httpd24-curl (Red Hat package)
jws5-tomcat (Red Hat package)
libnode64 (Ubuntu package)
nodejs (Ubuntu package)
libnode72 (Ubuntu package)
shim
shim-debuginfo
shim-debugsource
libnode108 (Ubuntu package)
edk2 (Ubuntu package)
edk2
edk2-ovmf
edk2-aarch64
python3-edk2-devel
edk2-help
edk2-debugsource
edk2-devel
edk2-debuginfo
edk2 (Red Hat package)
Network Observability plugin for the Openshift Console
IBM Cloud Pak System
JBoss Core Services
IBM MaaS360 VPN Module
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)
RecoverPoint for VMs
RSA Authentication Manager

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS subsystems with no message size limit. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://www.openssl.org/news/secadv/20230530.txt