Cryptographic issues in OpenSSL - CVE-2023-5363

Vulnerability identifier: #VU82349

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2023-5363

CWE-ID: CWE-310

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
OpenSSL
IBM AIX
Debian Linux
Amazon Linux AMI
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Linux Enterprise Micro
IBM i
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Basesystem Module
openSUSE Leap
Junos OS Evolved
Ubuntu
Anolis OS
openEuler
IBM VIOS
Red Hat OpenShift Builds
Service Interconnect
Splunk DB Connect
OpenShift Logging
Custom Metrics Autoscaler Operator for Red Hat OpenShift
IBM MaaS360 Cloud Extender Agent
IBM MaaS360 Mobile Enterprise Gateway
Red Hat OpenShift Dev Spaces
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat Migration Toolkit for Applications
IBM MQ for HPE NonStop
IBM Rational ClearCase
IBM QRadar WinCollect Agent
IBM Observability with Instana
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
HP-UX OpenSSL
Storage Resource Manager
Storage Ceph
Storage Protect for Virtual Environments: Data Protection for VMware
OpenShift API for Data Protection (OADP)
Red Hat OpenShift Container Platform
Nessus Network Monitor
VMware Horizon Client
LANTIME Operating System Firmware (LTOS)
FOS Firmware
OptiPlex Small Form Factor 7010
Precision 3460 Small Form Factor
Precision 3460 XE Small Form Factor
Precision 3450
Precision 3420 Tower
Precision 3280 CFF
Precision 3260 Compact
Precision 3260 XE Compact
OptiPlex XE4 Tower
OptiPlex XE4 SFF
OptiPlex Tower 7020
OptiPlex Tower Plus 7010
OptiPlex Tower 7010
OptiPlex Small Form Factor Plus 7010
Precision 3581
OptiPlex SFF 7020
OptiPlex Micro 7020
OptiPlex Micro Plus 7010
OptiPlex Micro 7010
Alienware x17 R1
OptiPlex AIO 7420
OptiPlex 7780 All-in-One
OptiPlex 7770 All-In-One
OptiPlex 7760 All-In-One
OptiPlex 7490 All-in-One
OptiPlex 7480 All-in-One
OptiPlex 7470 All-In-One
Vostro 5880
Alienware Area 51m R2
Alienware m15 R3
Alienware m15 R4
Alienware m17 R3
Alienware m17 R4
Alienware x14
Alienware x14 R2
Alienware x15 R1
Alienware x15 R2
Alienware x16 R1
XPS 13 Plus 9320
XPS 13 9315
Vostro 5890
Precision 3580
Vostro 5090
Vostro 3890
Vostro 15 3530
Vostro 15 3520
Vostro 14 3430
Vostro 14 3420
Precision 3930 Rack
Precision 3680 Tower
Precision 3660
Precision 3650 Tower
Precision 3640
Precision 3620 Tower
OptiPlex All-in-One 7410
Latitude 3540
Latitude 7330 Rugged Laptop
Latitude 7230 Rugged Extreme
Latitude 7220 Rugged Extreme
Latitude 7030 Rugged Extreme
Latitude 5540
Latitude 5430 Rugged Laptop
Latitude 5424 Rugged
Latitude 5420 Rugged
OptiPlex 7460 All In One
Latitude 5310 2-IN-1
Latitude 5310
Latitude 5300 2-IN-1
Latitude 5300
Latitude 5340
Latitude 3440
Latitude 3340
Latitude 3310 2-in-1
Latitude 3310
Inspiron 3891
Inspiron 15 3530
Inspiron 15 3520
Precision 7920 Tower
Precision 7820 Tower
Precision 5820 Tower
Precision 3630 Tower
Dell G5 5090
Alienware x17 R2
Latitude 7424 Rugged Extreme
OptiPlex 7450 All-In-One
OptiPlex 7400 All-In-One
Optiplex 7090 Ultra
OptiPlex 7090 Tower
OptiPlex 7000
OptiPlex 5490 All-In-One
OptiPlex 5480 All-In-One
OptiPlex 5400 All-In-One
OptiPlex 5270 All-In-One
OptiPlex 5260 All-In-One
OptiPlex 5090
OptiPlex 5080
Latitude 7340
OptiPlex 5000
OptiPlex 3280 All-in-One
OptiPlex 3090 Ultra
Latitude 9440 2-in-1
Latitude Rugged 7220EX
OptiPlex 3000
OptiPlex 3000 Thin Client
OptiPlex 3050 All-In-One
OptiPlex 3080
OptiPlex 3090
Latitude 3390 2-in-1
OptiPlex 3050
OptiPlex 5050
Latitude 3300
MySQL Server
MySQL Enterprise Monitor
IBM InfoSphere Information Server
MySQL Connectors
MySQL Workbench
IBM App Connect Enterprise
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libssl3 (Ubuntu package)
openssl (Red Hat package)
openssl
libopenssl3-debuginfo
libopenssl3-64bit-debuginfo
libopenssl3-64bit
libopenssl-3-devel-64bit
openssl-3-doc
libopenssl-3-devel-32bit
libopenssl3-32bit
libopenssl3-32bit-debuginfo
openssl-3-debuginfo
libopenssl3
openssl-3-debugsource
libopenssl-3-devel
openssl-3
openssl (Debian package)
openssl-devel
openssl-libs
openssl-perl
openssl-doc
edk2
python3-edk2-devel
edk2-ovmf
edk2-help
edk2-aarch64
edk2-devel
edk2-debugsource
edk2-debuginfo
Cisco Jabber
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Cisco Webex Meetings
IBM MaaS360 VPN Module
Dell EMC Storage Monitoring and Reporting (SMR)
OpenShift Data Foundation (formerly OpenShift Container Storage)
Precision 3240 Compact
OptiPlex 7071

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error when processing key and initialisation vector lengths in EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() function. A remote attacker can gain access to potentially sensitive information.

The following ciphers and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

Install updates from vendor's website.

• https://www.openssl.org/news/secadv/20231024.txt