Multiple OpenSSL Vulnerabilities Fixed

Rohan Timalsina

October 5, 2023 - TuxCare expert team

In 2023, a total of 17 vulnerabilities have been addressed in OpenSSL, a popular cryptography library. They pose a significant risk due to their potential to cause substantial availability disruptions. It consists of high, moderate, and low severity according to the OpenSSL severity metrics.

OpenSSL Vulnerabilities in 2023

CVE-2023-4807 (08 September 2023)

A bug was discovered within the POLY1305 Message Authentication Code (MAC) implementation that has the potential to disrupt the internal state of applications operating on the Windows 64-bit platform, particularly when running on modern X86_64 processors that support AVX512-IFMA instructions. This vulnerability does not affect other operating systems.

CVE-2023-2650 (30 May 2023)

The processing of certain specially crafted ASN.1 object identifiers or data containing them may experience significant performance slowdowns.

Applications directly utilizing OBJ_obj2txt() or employing OpenSSL subsystems such as OCSP, PKCS7/SMIME, CMS, CMP/CRMF, or TS without imposing message size limitations may encounter substantial to extensive processing delays for these messages, potentially resulting in a Denial of Service (DoS) scenario.

CVE-2023-0464 (21 March 2023)

A security vulnerability was discovered affecting all currently supported versions of OpenSSL. This vulnerability pertains to the verification of X.509 certificate chains containing policy constraints. Attackers have the potential to leverage this vulnerability by crafting a malicious certificate chain that induces exponential consumption of computational resources, ultimately resulting in a denial-of-service (DoS) attack on vulnerable systems.

CVE-2023-0286 (07 February 2023)

A vulnerability involving type confusion has been identified concerning processing X.400 addresses within an X.509 GeneralName. In this context, X.400 addresses were initially parsed as an ASN1_STRING, but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. Consequently, this field is misinterpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e., when the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability has the potential to allow an attacker to provide arbitrary pointers to a memcmp call. This, in turn, could enable the attacker to read memory contents or initiate a denial-of-service attack.

TuxCare’s LibCare for OpenSSL Security

LibCare, an add-on tool for KernelCare Enterprise, provides enterprise live patching services for shared libraries like glibc and OpenSSL, which are susceptible to security threats.

Given the substantial reliance of numerous servers on Linux-based operating systems, vulnerabilities in critical libraries like OpenSSL can pose significant risks. Don’t compromise on OpenSSL security or disrupt your operations any longer. With LibCare from TuxCare, enhance your company’s security posture with automated and non-disruptive library patching now.

Final Thoughts

OpenSSL vulnerabilities could be maliciously leveraged to execute DoS attacks, potentially leading to the loss of system accessibility and even compromising system integrity. To safeguard your systems against these threats, it is essential to promptly apply the security update provided by OpenSSL. We strongly urge all affected users to immediately implement the OpenSSL updates distributed by their respective distributions.

TuxCare has already released patches for the above-mentioned vulnerabilities. For more information, visit the CVE Dashboard.

The source for this story is available at OpenSSL.

Summary