Resource management error in OpenSSL - CVE-2023-3446

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU78463

Resource management error in OpenSSL - CVE-2023-3446

Published: July 20, 2023 / Updated: August 2, 2023


Vulnerability identifier: #VU78463
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-3446
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available
Affected software:
OpenSSL
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Fedora
SUSE Enterprise Storage
IBM i
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE
Legacy Module
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
Slackware Linux
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
openEuler
Junos OS Evolved
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
Cognos Dashboards on Cloud Pak for Data
webMethods Managed File Transfer
ObjectScale
Storage Defender – Data Protect
IBM Planning Analytics Workspace
Storage Copy Data Management
IBM OS Image for Red Hat Linux Systems
Enterprise SONiC
Dell Policy Manager for Secure Connect Gateway (SCG)
Storage Ceph
Storage Protect Client
Storage Virtualize
IBM supplied MQ Advanced container images
IBM Sterling Order Management
SmartFabric OS10
Cognos Transformer
Dell PowerProtect Cyber Recovery
Red Hat OpenShift Serverless
OpenShift Service Mesh
OpenShift Virtualization
OpenShift Container Platform for Windows Containers
Red Hat OpenShift Builds
Data Lakehouse
Migration Toolkit for Runtimes
Service Telemetry Framework
Cryostat
IBM Cloud Pak for Data System
IBM Cloud Transformation Advisor
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
IBM Rational Build Forge
Tenable Nessus
Multicluster GlobalHub
Sensor Proxy
Service Interconnect
IBM MQ Operator
Ansible Automation Platform
Custom Metrics Autoscaler Operator for Red Hat OpenShift
Red Hat OpenShift distributed tracing (RHOSDT)
Red Hat OpenShift Dev Spaces
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
EasyApache
App Connect Enterprise Certified Container
IBM Spectrum Control
Red Hat Migration Toolkit for Applications
Session Smart Router
IBM Maximo Application Suite
IBM Rational ClearQuest
IBM Rational ClearCase
IBM Security Verify Governance
IBM Power Hardware Management Console (HMC)
InfoSphere Master Data Management
Red Hat OpenStack
NetWorker
Juniper Cloud Native Router
Voice Gateway
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
QRadar Suite
Splunk Enterprise
JBoss Web Server
IBM Qradar SIEM
Nessus Agent
Event Streams
TeleControl Server Basic
NetWorker Management Console
Red Hat Single Sign-On
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
openssl (Ubuntu package)
libssl1.0.0 (Ubuntu package)
libssl1.1 (Ubuntu package)
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
libopenssl0_9_8-hmac
libopenssl0_9_8-hmac-32bit
openssl
libopenssl0_9_8-32bit
libopenssl0_9_8
openssl-doc
libopenssl0_9_8-debuginfo
compat-openssl098-debugsource
libopenssl0_9_8-debuginfo-32bit
jbcs-httpd24-openssl-chil (Red Hat package)
openssl1-doc
libopenssl1-devel
libopenssl1_0_0-32bit
libopenssl1_0_0
openssl1
libopenssl1_0_0-hmac
openssl-debugsource
libopenssl1_0_0-debuginfo
libopenssl1_0_0-debuginfo-32bit
libopenssl-devel
openssl-debuginfo
libopenssl1_0_0-hmac-32bit
openssl-1_0_0
openssl-1_0_0-doc
libopenssl-1_0_0-devel-32bit
libopenssl-1_0_0-devel
openssl-1_0_0-debuginfo
openssl-1_0_0-debugsource
libopenssl1_0_0-32bit-debuginfo
libopenssl1_0_0-steam-32bit-debuginfo
libopenssl1_0_0-steam-32bit
openssl-1_0_0-cavs-debuginfo
libopenssl1_0_0-steam
openssl-1_0_0-cavs
libopenssl1_0_0-steam-debuginfo
libopenssl10
libopenssl10-debuginfo
libopenssl1_1-32bit
libopenssl1_1-32bit-debuginfo
libopenssl-1_1-devel-32bit
libopenssl1_1-hmac-32bit
libopenssl-1_1-devel
libopenssl1_1
openssl-1_1
openssl-1_1-debugsource
libopenssl1_1-debuginfo
libopenssl1_1-hmac
openssl-1_1-debuginfo
libopenssl1_1-debuginfo-32bit
openssl-1_1-doc
openssl-devel
openssl-libs
openssl-help
openssl11
openssl-perl
openssl (Red Hat package)
libopenssl-1_1-devel-64bit
libopenssl1_1-64bit-debuginfo
libopenssl1_1-64bit
libopenssl1_1-hmac-64bit
openssl1.1
openssl1.1-devel
openssl1.1-doc
openssl-solibs
jws5-tomcat-native (Red Hat package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
libssl3 (Ubuntu package)
openssl-fips-provider (Red Hat package)
libopenssl-3-devel-64bit
openssl-3-debugsource
libopenssl3-32bit-debuginfo
openssl-3-doc
libopenssl3-64bit-debuginfo
libopenssl-3-devel
openssl-3
libopenssl3-debuginfo
libopenssl3-32bit
libopenssl-3-devel-32bit
libopenssl3
libopenssl3-64bit
openssl-3-debuginfo
dev-libs/openssl
jbcs-httpd24-curl (Red Hat package)
jws5-tomcat (Red Hat package)
shim
shim-debuginfo
shim-debugsource
edk2 (Ubuntu package)
edk2-debugsource
edk2-devel
python3-edk2-devel
edk2-aarch64
edk2-debuginfo
edk2
edk2-ovmf
edk2-help
edk2 (Red Hat package)
edk2-tools-doc
Splunk Universal Forwarder
IBM Storage Scale System
IBM App Connect Enterprise
IBM CICS TX Advanced
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
Red Hat OpenShift GitOps
IBM Integrated Analytics System
Dell G15 5511
Alienware m15 R6
XPS 8960
FOS Firmware
Junos cRPD
IBM Cloud Pak System
JBoss Core Services
SIMATIC MV500
RecoverPoint for VMs
Dell EMC VxRail Appliance
IBM Security Verify Access
IBM InfoSphere Information Server

Detailed vulnerability description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the DH_check(), DH_check_ex() and EVP_PKEY_param_check() function when processing a DH key or DH parameters. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.


How to mitigate CVE-2023-3446

Install update from vendor's website.

Sources