Resource management error in OpenSSL - CVE-2023-6237

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU85399

Resource management error in OpenSSL - CVE-2023-6237

Published: January 15, 2024 / Updated: April 8, 2024


Vulnerability identifier: #VU85399
CSH Severity: Low
CVSS v4 BT: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-6237
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the way the EVP_PKEY_public_check() function handles RSA public keys. A remote attacker can supply an RSA key obtained from an untrusted source and perform a denial of service (DoS) attack.


Affected software

OpenSSL
IBM Business Automation Workflow
IBM Rational Build Forge
WebSphere Remote Server
IBM Automation Decision Services
Service Interconnect
Ansible Automation Platform
Red Hat Advanced Cluster Management for Kubernetes
Custom Metrics Autoscaler Operator for Red Hat OpenShift
IBM MaaS360 Mobile Enterprise Gateway
Red Hat OpenShift Dev Spaces
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat Migration Toolkit for Applications
IBM MQ
IBM Rational ClearQuest
IBM Rational ClearCase
Rational Application Developer
IBM Workload Scheduler
Red Hat OpenStack
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
Amazon Linux AMI
IBM AIX
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
IBM i
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Brocade Fabric OS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Basesystem Module
openSUSE Leap
Ubuntu
Anolis OS
Fedora
Rational Developer for i RPG and COBOL + Modernization Tools, Java Edition
Guardium Data Security Center (GDSC)
HP-UX OpenSSL
IBM Cloud Pak for Watson AIOps
Maximo Application Suite - Edge Data Collector
Robotic Process Automation for Cloud Pak
IBM VIOS
Voice Gateway
FOS Firmware
OptiPlex Tower 7010
OptiPlex Tower Plus 7010
OptiPlex Tower 7020
OptiPlex XE4 SFF
OptiPlex XE4 Tower
Precision 3260 XE Compact
Precision 3260 Compact
Precision 3280 CFF
Precision 3420 Tower
Alienware m17 R4
Precision 3450
OptiPlex Small Form Factor Plus 7010
OptiPlex Small Form Factor 7010
OptiPlex SFF 7020
OptiPlex Micro 7020
OptiPlex Micro Plus 7010
OptiPlex Micro 7010
OptiPlex All-in-One 7410
OptiPlex AIO 7420
OptiPlex 7780 All-in-One
OptiPlex 7770 All-In-One
OptiPlex 7760 All-In-One
OptiPlex 7490 All-in-One
Vostro 15 3520
Alienware Area 51m R2
Alienware m15 R3
Alienware m15 R4
Alienware m17 R3
XPS 13 Plus 9320
XPS 13 9315
Vostro 5890
Vostro 5880
Vostro 5090
Vostro 3890
Vostro 15 3530
Precision 3460 XE Small Form Factor
Vostro 14 3430
Vostro 14 3420
Precision 3930 Rack
Precision 3680 Tower
Precision 3660
Precision 3650 Tower
Precision 3640
Precision 3620 Tower
Precision 3581
Precision 3580
Precision 3460 Small Form Factor
Latitude 3310
Latitude 7220 Rugged Extreme
Latitude 7030 Rugged Extreme
OptiPlex 7480 All-in-One
Latitude 5430 Rugged Laptop
Latitude 5424 Rugged
Latitude 5420 Rugged
Latitude 5340
Latitude 5310 2-IN-1
Latitude 5310
Latitude 5300 2-IN-1
Latitude 5300
Latitude 3540
Latitude 3440
Latitude 3340
Latitude 3310 2-in-1
Latitude 5540
Inspiron 3891
Inspiron 15 3530
Inspiron 15 3520
Precision 7920 Tower
Precision 7820 Tower
Precision 5820 Tower
Precision 3630 Tower
Dell G5 5090
Alienware x17 R2
Alienware x17 R1
Alienware x16 R1
Alienware x15 R2
Alienware x15 R1
Alienware x14 R2
Alienware x14
Latitude 7330 Rugged Laptop
OptiPlex 7470 All-In-One
OptiPlex 7460 All In One
OptiPlex 7450 All-In-One
OptiPlex 7400 All-In-One
Optiplex 7090 Ultra
OptiPlex 7090 Tower
OptiPlex 7000
OptiPlex 5490 All-In-One
OptiPlex 5480 All-In-One
OptiPlex 5400 All-In-One
OptiPlex 5270 All-In-One
OptiPlex 5260 All-In-One
OptiPlex 5090
OptiPlex 5080
OptiPlex 3080
Latitude 7230 Rugged Extreme
Latitude 7340
Latitude 7424 Rugged Extreme
Latitude 9440 2-in-1
Latitude Rugged 7220EX
OptiPlex 3000
OptiPlex 3000 Thin Client
OptiPlex 3050 All-In-One
OptiPlex 5000
OptiPlex 3090
OptiPlex 3090 Ultra
OptiPlex 3280 All-in-One
OptiPlex 3050
Latitude 3390 2-in-1
Latitude 3300
OptiPlex 5050
libssl1.1 (Ubuntu package)
libssl3 (Ubuntu package)
openssl-fips-provider (Red Hat package)
openssl (Red Hat package)
openssl
openssl-3-debuginfo
libopenssl-3-devel
libopenssl3-debuginfo
openssl-3-debugsource
openssl-3
libopenssl3
libopenssl-3-devel-32bit
libopenssl3-32bit
libopenssl3-32bit-debuginfo
openssl-3-doc
libopenssl3-64bit-debuginfo
libopenssl-3-devel-64bit
libopenssl3-64bit
openssl-libs
openssl-doc
openssl-perl
openssl-devel
edk2 (Ubuntu package)
edk2 (Red Hat package)
edk2
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
OpenShift Service Mesh
OpenShift Virtualization
OpenShift Container Platform for Windows Containers
IBM MaaS360 VPN Module
Red Hat OpenShift Container Platform
IBM InfoSphere Information Server
Precision 3240 Compact
OptiPlex 7071

How to mitigate CVE-2023-6237

Install update from vendor's website.

OpenSSL - addressed in versions 3.0.13, 3.1.5, 3.2.1
Voice Gateway - update to 1.0.8.12
Guardium Data Security Center (GDSC) - update to 3.6.1
IBM Rational Build Forge - update to 8.0.0.26
FOS Firmware - addressed in versions 9.2.0c, 9.2.1b, 9.2.2
Brocade Fabric OS - addressed in versions 9.2.0c, 9.2.1a1, 9.2.2
IBM Automation Decision Services - update to 24.0.0.0.4
HP-UX OpenSSL - update to A.03.00.15.001
libssl1.1 (Ubuntu package) - update to 1.1.1f-1ubuntu2.21
OpenShift API for Data Protection (OADP) - update to 1.3.2
Service Interconnect - update to 1.5.4
Network Observability plugin for the Openshift Console - update to 1.6.0
Ansible Automation Platform - update to 2.4
OpenShift Service Mesh - addressed in versions 2.4.8, 2.5.2
Red Hat Advanced Cluster Management for Kubernetes - update to 2.10.5
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-394
libssl3 (Ubuntu package) - addressed in versions 3.0.2-0ubuntu1.14, 3.0.10-1ubuntu2.2
openssl-fips-provider (Red Hat package) - update to 3.0.7-2.el9
openssl (Red Hat package) - update to 3.0.7-27.el9
openssl - update to 3.0.8-1
openssl-3-debuginfo - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
libopenssl-3-devel - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
libopenssl3-debuginfo - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
openssl-3-debugsource - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
openssl-3 - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
libopenssl3 - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
libopenssl-3-devel-32bit - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
libopenssl3-32bit - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
libopenssl3-32bit-debuginfo - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
openssl-3-doc - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
libopenssl3-64bit-debuginfo - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
libopenssl-3-devel-64bit - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
libopenssl3-64bit - addressed in versions 3.0.8-150400.4.49.1, 3.0.8-150500.5.24.1
openssl-libs - update to 3.0.12-5
openssl-doc - update to 3.0.12-5
openssl-perl - update to 3.0.12-5
openssl-devel - update to 3.0.12-5
openssl - update to 3.0.12-5
IBM MaaS360 VPN Module - update to 3.000.800
IBM MaaS360 Mobile Enterprise Gateway - update to 3.000.800
Red Hat OpenShift Dev Spaces - update to 3.16.0
IBM Cloud Pak for Watson AIOps - update to 4.7.0
OpenShift Virtualization - update to 4.14.6
Red Hat OpenShift Container Platform - update to 4.17.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.1
Red Hat Migration Toolkit for Applications - addressed in versions 6.2.3, 7.0.3
OpenShift Container Platform for Windows Containers - addressed in versions 8.1.3, 10.15.3
Maximo Application Suite - Edge Data Collector - update to 8.11.7
IBM MQ - addressed in versions 9.0.0.24, 9.1.0.21, 9.2.0.25, 9.3.0.17
IBM Rational ClearQuest - update to 9.1.0.7
IBM Rational ClearCase - addressed in versions 9.1.0.7, 10.0.1.2, 11.0.0.1
Rational Application Developer - update to 9.7.0.6
IBM Workload Scheduler - update to 10.2.2
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
Red Hat OpenStack - update to 17.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.33, 23.0.2.5
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
IBM Robotic Process Automation - addressed in versions 21.0.7.15, 23.0.16
edk2 (Ubuntu package) - addressed in versions 2022.02-3ubuntu0.22.04.4, 2022.02-3ubuntu0.22.04.5, 2024.02-2ubuntu0.6, 2024.02-2ubuntu0.7, 2025.02-3ubuntu2.2
OptiPlex Tower 7010 - update to 2413.5.68.0
OptiPlex Tower Plus 7010 - update to 2413.5.68.0
OptiPlex Tower 7020 - update to 2413.5.68.0
OptiPlex XE4 SFF - update to 2413.5.68.0
OptiPlex XE4 Tower - update to 2413.5.68.0
Precision 3240 Compact - update to 2413.5.68.0
Precision 3260 XE Compact - update to 2413.5.68.0
Precision 3260 Compact - update to 2413.5.68.0
Precision 3280 CFF - update to 2413.5.68.0
Precision 3420 Tower - update to 2413.5.68.0
Alienware m17 R4 - update to 2413.5.68.0
Precision 3450 - update to 2413.5.68.0
OptiPlex Small Form Factor Plus 7010 - update to 2413.5.68.0
OptiPlex Small Form Factor 7010 - update to 2413.5.68.0
OptiPlex SFF 7020 - update to 2413.5.68.0
OptiPlex Micro 7020 - update to 2413.5.68.0
OptiPlex Micro Plus 7010 - update to 2413.5.68.0
OptiPlex Micro 7010 - update to 2413.5.68.0
OptiPlex All-in-One 7410 - update to 2413.5.68.0
OptiPlex AIO 7420 - update to 2413.5.68.0
OptiPlex 7780 All-in-One - update to 2413.5.68.0
OptiPlex 7770 All-In-One - update to 2413.5.68.0
OptiPlex 7760 All-In-One - update to 2413.5.68.0
OptiPlex 7490 All-in-One - update to 2413.5.68.0
Vostro 15 3520 - update to 2413.5.68.0
Alienware Area 51m R2 - update to 2413.5.68.0
Alienware m15 R3 - update to 2413.5.68.0
Alienware m15 R4 - update to 2413.5.68.0
Alienware m17 R3 - update to 2413.5.68.0
XPS 13 Plus 9320 - update to 2413.5.68.0
XPS 13 9315 - update to 2413.5.68.0
Vostro 5890 - update to 2413.5.68.0
Vostro 5880 - update to 2413.5.68.0
Vostro 5090 - update to 2413.5.68.0
Vostro 3890 - update to 2413.5.68.0
Vostro 15 3530 - update to 2413.5.68.0
Precision 3460 XE Small Form Factor - update to 2413.5.68.0
Vostro 14 3430 - update to 2413.5.68.0
Vostro 14 3420 - update to 2413.5.68.0
Precision 3930 Rack - update to 2413.5.68.0
Precision 3680 Tower - update to 2413.5.68.0
Precision 3660 - update to 2413.5.68.0
Precision 3650 Tower - update to 2413.5.68.0
Precision 3640 - update to 2413.5.68.0
Precision 3620 Tower - update to 2413.5.68.0
Precision 3581 - update to 2413.5.68.0
Precision 3580 - update to 2413.5.68.0
Precision 3460 Small Form Factor - update to 2413.5.68.0
Latitude 3310 - update to 2413.5.68.0
Latitude 7220 Rugged Extreme - update to 2413.5.68.0
Latitude 7030 Rugged Extreme - update to 2413.5.68.0
OptiPlex 7480 All-in-One - update to 2413.5.68.0
Latitude 5430 Rugged Laptop - update to 2413.5.68.0
Latitude 5424 Rugged - update to 2413.5.68.0
Latitude 5420 Rugged - update to 2413.5.68.0
Latitude 5340 - update to 2413.5.68.0
Latitude 5310 2-IN-1 - update to 2413.5.68.0
Latitude 5310 - update to 2413.5.68.0
Latitude 5300 2-IN-1 - update to 2413.5.68.0
Latitude 5300 - update to 2413.5.68.0
Latitude 3540 - update to 2413.5.68.0
Latitude 3440 - update to 2413.5.68.0
Latitude 3340 - update to 2413.5.68.0
Latitude 3310 2-in-1 - update to 2413.5.68.0
Latitude 5540 - update to 2413.5.68.0
Inspiron 3891 - update to 2413.5.68.0
Inspiron 15 3530 - update to 2413.5.68.0
Inspiron 15 3520 - update to 2413.5.68.0
Precision 7920 Tower - update to 2413.5.68.0
Precision 7820 Tower - update to 2413.5.68.0
Precision 5820 Tower - update to 2413.5.68.0
Precision 3630 Tower - update to 2413.5.68.0
Dell G5 5090 - update to 2413.5.68.0
Alienware x17 R2 - update to 2413.5.68.0
Alienware x17 R1 - update to 2413.5.68.0
Alienware x16 R1 - update to 2413.5.68.0
Alienware x15 R2 - update to 2413.5.68.0
Alienware x15 R1 - update to 2413.5.68.0
Alienware x14 R2 - update to 2413.5.68.0
Alienware x14 - update to 2413.5.68.0
Latitude 7330 Rugged Laptop - update to 2413.5.68.0
OptiPlex 7470 All-In-One - update to 2413.5.68.0
OptiPlex 7460 All In One - update to 2413.5.68.0
OptiPlex 7450 All-In-One - update to 2413.5.68.0
OptiPlex 7400 All-In-One - update to 2413.5.68.0
Optiplex 7090 Ultra - update to 2413.5.68.0
OptiPlex 7090 Tower - update to 2413.5.68.0
OptiPlex 7071 - update to 2413.5.68.0
OptiPlex 7000 - update to 2413.5.68.0
OptiPlex 5490 All-In-One - update to 2413.5.68.0
OptiPlex 5480 All-In-One - update to 2413.5.68.0
OptiPlex 5400 All-In-One - update to 2413.5.68.0
OptiPlex 5270 All-In-One - update to 2413.5.68.0
OptiPlex 5260 All-In-One - update to 2413.5.68.0
OptiPlex 5090 - update to 2413.5.68.0
OptiPlex 5080 - update to 2413.5.68.0
OptiPlex 3080 - update to 2413.5.68.0
Latitude 7230 Rugged Extreme - update to 2413.5.68.0
Latitude 7340 - update to 2413.5.68.0
Latitude 7424 Rugged Extreme - update to 2413.5.68.0
Latitude 9440 2-in-1 - update to 2413.5.68.0
Latitude Rugged 7220EX - update to 2413.5.68.0
OptiPlex 3000 - update to 2413.5.68.0
OptiPlex 3000 Thin Client - update to 2413.5.68.0
OptiPlex 3050 All-In-One - update to 2413.5.68.0
OptiPlex 5000 - update to 2413.5.68.0
OptiPlex 3090 - update to 2413.5.68.0
OptiPlex 3090 Ultra - update to 2413.5.68.0
OptiPlex 3280 All-in-One - update to 2413.5.68.0
OptiPlex 3050 - update to 2435.6.35.0
Latitude 3390 2-in-1 - update to 2435.6.35.0
Latitude 3300 - update to 2435.6.35.0
OptiPlex 5050 - update to 2435.6.35.0
edk2 (Red Hat package) - update to 20240524-6.el9_5
edk2 - addressed in versions 20240813-2.fc40, 20240813-2.fc41

External References

Related Security Bulletins