Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the Op…
Medium CVSS 6.5
Summary
Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
Sources
- NVD DATABASE
Original Links
- http://www.openwall.com/lists/oss-security/2023/05/30/1 Mailing List
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b Mailing List
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c Broken Link
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098 Mailing List
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a Mailing List
- https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html Mailing List
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009 Third Party Advisory
- https://security.gentoo.org/glsa/202402-08
- https://security.netapp.com/advisory/ntap-20230703-0001/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231027-0009/
- https://www.debian.org/security/2023/dsa-5417 Third Party Advisory
- https://www.openssl.org/news/secadv/20230530.txt Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/05/30/1 Mailing List
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b Mailing List
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c Broken Link
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098 Mailing List
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a Mailing List
- https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html Mailing List
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009 Third Party Advisory
- https://security.gentoo.org/glsa/202402-08
- https://security.netapp.com/advisory/ntap-20230703-0001/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231027-0009/
- https://www.debian.org/security/2023/dsa-5417 Third Party Advisory
- https://www.openssl.org/news/secadv/20230530.txt Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-699386.html
- https://cert-portal.siemens.com/productcert/html/ssa-943925.html
Timeline
- nvd_ingest NVD