CVE - CVE-2023-3817

CVE-ID
CVE-2023-3817	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20230818-0014/ CONFIRM:https://security.netapp.com/advisory/ntap-20231027-0008/ FULLDISC:20230724 APPLE-SA-2023-07-24-1 Safari 16.6 URL:http://seclists.org/fulldisclosure/2023/Jul/43 GENTOO:GLSA-202402-08 URL:https://security.gentoo.org/glsa/202402-08 MISC:1.0.2zi patch (premium) URL:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644 MISC:1.1.1v git commit URL:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5 MISC:3.0.10 git commit URL:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f MISC:3.1.2 git commit URL:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5 MISC:OpenSSL Advisory URL:https://www.openssl.org/news/secadv/20230731.txt MLIST:[debian-lts-announce] 20230816 [SECURITY] [DLA 3530-1] openssl security update URL:https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html MLIST:[oss-security] 20230731 OpenSSL Security Advisory URL:http://www.openwall.com/lists/oss-security/2023/07/31/1 MLIST:[oss-security] 20230922 Re: illumos (or at least danmcd) membership in the distros list URL:http://www.openwall.com/lists/oss-security/2023/09/22/11 MLIST:[oss-security] 20230922 Re: illumos (or at least danmcd) membership in the distros list URL:http://www.openwall.com/lists/oss-security/2023/09/22/9 MLIST:[oss-security] 20231106 OpenSSL Security Advisory URL:http://www.openwall.com/lists/oss-security/2023/11/06/2
Assigning CNA
OpenSSL Software Foundation
Date Record Created
20230721	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230721)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)