OpenSSL up to 3.0.7 PKCS7 Data Verification null pointer dereference

Summaryinfo

A vulnerability labeled as problematic has been found in OpenSSL up to 3.0.7. This issue affects some unknown processing of the component PKCS7 Data Verification. The manipulation results in null pointer dereference. This vulnerability is identified as CVE-2023-0401. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in OpenSSL up to 3.0.7 (Network Encryption Software). Affected is an unknown part of the component PKCS7 Data Verification. The manipulation with an unknown input leads to a null pointer dereference vulnerability. CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. This is going to have an impact on availability. CVE summarizes:

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.

The weakness was released 02/07/2023 by Hubert Kario and Dmitry Belyavsky. The advisory is shared for download at openssl.org. This vulnerability is traded as CVE-2023-0401. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 210336 (Oracle Business Intelligence Enterprise Edition (October 2024 CPU)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.8 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210336). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion