CVE-2023-0215

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-0215
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0215.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-0215
Aliases
Related
Published
2023-02-08T20:15:24Z
Modified
2024-12-05T15:35:03.219917Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.

The function receives a BIO from the caller, prepends a new BIOfasn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.

This scenario occurs directly in the internal function B64writeASN1() which may cause BIOnewNDEF() to be called and will subsequently call BIOpop() on the BIO. This internal function is in turn called by the public API functions PEMwritebioASN1stream, PEMwritebioCMSstream, PEMwritebioPKCS7stream, SMIMEwriteASN1, SMIMEwriteCMS and SMIMEwrite_PKCS7.

Other public API functions that may be impacted by this include i2dASN1biostream, BIOnewCMS, BIOnewPKCS7, i2dCMSbiostream and i2dPKCS7bio_stream.

The OpenSSL cms and smime command line applications are similarly affected.

References

Affected packages

Alpine:v3.14 / openssl

Package

Name
openssl
Purl
pkg:apk/alpine/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1t-r0

Affected versions

1.*

1.1.1-r1
1.1.1-r2
1.1.1-r3
1.1.1-r4
1.1.1-r5
1.1.1a-r0
1.1.1a-r1
1.1.1b-r0
1.1.1b-r1
1.1.1c-r0
1.1.1c-r1
1.1.1d-r1
1.1.1d-r2
1.1.1d-r3
1.1.1d-r4
1.1.1d-r5
1.1.1e-r0
1.1.1f-r0
1.1.1g-r0
1.1.1h-r0
1.1.1i-r0
1.1.1j-r0
1.1.1k-r0
1.1.1l-r0
1.1.1n-r0
1.1.1o-r0
1.1.1p-r0
1.1.1q-r0
1.1.1s-r0

Alpine:v3.15 / openssl

Package

Name
openssl
Purl
pkg:apk/alpine/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1t-r0

Affected versions

1.*

1.1.1l-r2
1.1.1l-r3
1.1.1l-r4
1.1.1l-r5
1.1.1l-r6
1.1.1l-r7
1.1.1l-r8
1.1.1n-r0
1.1.1o-r0
1.1.1p-r0
1.1.1q-r0
1.1.1s-r0
1.1.1s-r1

Alpine:v3.15 / openssl3

Package

Name
openssl3
Purl
pkg:apk/alpine/openssl3?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8-r0

Affected versions

1.*

1.1.1-r0
1.1.1-r1
1.1.1-r2
1.1.1-r3
1.1.1-r4
1.1.1-r5
1.1.1a-r0
1.1.1a-r1
1.1.1b-r0
1.1.1b-r1
1.1.1c-r0
1.1.1c-r1
1.1.1d-r1
1.1.1d-r2
1.1.1d-r3
1.1.1d-r4
1.1.1d-r5
1.1.1e-r0
1.1.1f-r0
1.1.1g-r0
1.1.1h-r0
1.1.1i-r0
1.1.1j-r0
1.1.1k-r0
1.1.1k-r1
1.1.1l-r0

3.*

3.0.0-r0
3.0.0-r1
3.0.0-r2
3.0.0-r3
3.0.0-r4
3.0.2-r0
3.0.3-r0
3.0.5-r0
3.0.5-r1
3.0.6-r0
3.0.7-r0

Alpine:v3.16 / openssl

Package

Name
openssl
Purl
pkg:apk/alpine/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1t-r0

Affected versions

1.*

1.1.1l-r2
1.1.1l-r3
1.1.1l-r4
1.1.1l-r5
1.1.1l-r6
1.1.1l-r7
1.1.1m-r0
1.1.1m-r1
1.1.1m-r2
1.1.1m-r3
1.1.1n-r0
1.1.1o-r0
1.1.1p-r0
1.1.1q-r0
1.1.1s-r0

Alpine:v3.16 / openssl3

Package

Name
openssl3
Purl
pkg:apk/alpine/openssl3?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8-r0

Affected versions

1.*

1.1.1-r0
1.1.1-r1
1.1.1-r2
1.1.1-r3
1.1.1-r4
1.1.1-r5
1.1.1a-r0
1.1.1a-r1
1.1.1b-r0
1.1.1b-r1
1.1.1c-r0
1.1.1c-r1
1.1.1d-r1
1.1.1d-r2
1.1.1d-r3
1.1.1d-r4
1.1.1d-r5
1.1.1e-r0
1.1.1f-r0
1.1.1g-r0
1.1.1h-r0
1.1.1i-r0
1.1.1j-r0
1.1.1k-r0
1.1.1k-r1
1.1.1l-r0

3.*

3.0.0-r0
3.0.0-r1
3.0.0-r2
3.0.0-r3
3.0.0-r4
3.0.1-r0
3.0.1-r1
3.0.2-r0
3.0.3-r0
3.0.5-r0
3.0.5-r1
3.0.6-r0
3.0.7-r0

Alpine:v3.17 / openssl

Package

Name
openssl
Purl
pkg:apk/alpine/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8-r0

Affected versions

1.*

1.1.1-r0
1.1.1-r1
1.1.1-r2
1.1.1-r3
1.1.1-r4
1.1.1-r5
1.1.1a-r0
1.1.1a-r1
1.1.1b-r0
1.1.1b-r1
1.1.1c-r0
1.1.1c-r1
1.1.1d-r1
1.1.1d-r2
1.1.1d-r3
1.1.1d-r4
1.1.1d-r5
1.1.1e-r0
1.1.1f-r0
1.1.1g-r0
1.1.1h-r0
1.1.1i-r0
1.1.1j-r0
1.1.1k-r0
1.1.1k-r1
1.1.1l-r0

3.*

3.0.0-r0
3.0.0-r1
3.0.0-r2
3.0.0-r3
3.0.0-r4
3.0.1-r0
3.0.1-r1
3.0.2-r0
3.0.3-r0
3.0.5-r0
3.0.5-r1
3.0.5-r2
3.0.5-r3
3.0.6-r0
3.0.7-r0
3.0.7-r2

Alpine:v3.18 / openssl

Package

Name
openssl
Purl
pkg:apk/alpine/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8-r0

Affected versions

1.*

1.1.1-r0
1.1.1-r1
1.1.1-r2
1.1.1-r3
1.1.1-r4
1.1.1-r5
1.1.1a-r0
1.1.1a-r1
1.1.1b-r0
1.1.1b-r1
1.1.1c-r0
1.1.1c-r1
1.1.1d-r1
1.1.1d-r2
1.1.1d-r3
1.1.1d-r4
1.1.1d-r5
1.1.1e-r0
1.1.1f-r0
1.1.1g-r0
1.1.1h-r0
1.1.1i-r0
1.1.1j-r0
1.1.1k-r0
1.1.1k-r1
1.1.1l-r0

3.*

3.0.0-r0
3.0.0-r1
3.0.0-r2
3.0.0-r3
3.0.0-r4
3.0.1-r0
3.0.1-r1
3.0.2-r0
3.0.3-r0
3.0.5-r0
3.0.5-r1
3.0.5-r2
3.0.5-r3
3.0.6-r0
3.0.7-r0
3.0.7-r1
3.0.7-r2

Alpine:v3.19 / openssl

Package

Name
openssl
Purl
pkg:apk/alpine/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8-r0

Affected versions

1.*

1.1.1-r0
1.1.1-r1
1.1.1-r2
1.1.1-r3
1.1.1-r4
1.1.1-r5
1.1.1a-r0
1.1.1a-r1
1.1.1b-r0
1.1.1b-r1
1.1.1c-r0
1.1.1c-r1
1.1.1d-r1
1.1.1d-r2
1.1.1d-r3
1.1.1d-r4
1.1.1d-r5
1.1.1e-r0
1.1.1f-r0
1.1.1g-r0
1.1.1h-r0
1.1.1i-r0
1.1.1j-r0
1.1.1k-r0
1.1.1k-r1
1.1.1l-r0

3.*

3.0.0-r0
3.0.0-r1
3.0.0-r2
3.0.0-r3
3.0.0-r4
3.0.1-r0
3.0.1-r1
3.0.2-r0
3.0.3-r0
3.0.5-r0
3.0.5-r1
3.0.5-r2
3.0.5-r3
3.0.6-r0
3.0.7-r0
3.0.7-r1
3.0.7-r2

Alpine:v3.20 / openssl

Package

Name
openssl
Purl
pkg:apk/alpine/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8-r0

Affected versions

1.*

1.1.1-r0
1.1.1-r1
1.1.1-r2
1.1.1-r3
1.1.1-r4
1.1.1-r5
1.1.1a-r0
1.1.1a-r1
1.1.1b-r0
1.1.1b-r1
1.1.1c-r0
1.1.1c-r1
1.1.1d-r1
1.1.1d-r2
1.1.1d-r3
1.1.1d-r4
1.1.1d-r5
1.1.1e-r0
1.1.1f-r0
1.1.1g-r0
1.1.1h-r0
1.1.1i-r0
1.1.1j-r0
1.1.1k-r0
1.1.1k-r1
1.1.1l-r0

3.*

3.0.0-r0
3.0.0-r1
3.0.0-r2
3.0.0-r3
3.0.0-r4
3.0.1-r0
3.0.1-r1
3.0.2-r0
3.0.3-r0
3.0.5-r0
3.0.5-r1
3.0.5-r2
3.0.5-r3
3.0.6-r0
3.0.7-r0
3.0.7-r1
3.0.7-r2

Alpine:v3.21 / openssl

Package

Name
openssl
Purl
pkg:apk/alpine/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8-r0

Affected versions

1.*

1.1.1-r0
1.1.1-r1
1.1.1-r2
1.1.1-r3
1.1.1-r4
1.1.1-r5
1.1.1a-r0
1.1.1a-r1
1.1.1b-r0
1.1.1b-r1
1.1.1c-r0
1.1.1c-r1
1.1.1d-r1
1.1.1d-r2
1.1.1d-r3
1.1.1d-r4
1.1.1d-r5
1.1.1e-r0
1.1.1f-r0
1.1.1g-r0
1.1.1h-r0
1.1.1i-r0
1.1.1j-r0
1.1.1k-r0
1.1.1k-r1
1.1.1l-r0

3.*

3.0.0-r0
3.0.0-r1
3.0.0-r2
3.0.0-r3
3.0.0-r4
3.0.1-r0
3.0.1-r1
3.0.2-r0
3.0.3-r0
3.0.5-r0
3.0.5-r1
3.0.5-r2
3.0.5-r3
3.0.6-r0
3.0.7-r0
3.0.7-r1
3.0.7-r2

Debian:11 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1n-0+deb11u4

Affected versions

1.*

1.1.1k-1
1.1.1k-1+deb11u1
1.1.1k-1+deb11u2
1.1.1l-1
1.1.1m-0+deb11u1
1.1.1m-1
1.1.1n-0+deb11u1
1.1.1n-0+deb11u2
1.1.1n-0+deb11u3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
89cd17a031e022211684eb7eb41190cf1910f9fa
Fixed
31157bc0b46e04227b8468d3e6915e4d0332777c

Affected versions

openssl-3.*

openssl-3.0.0
openssl-3.0.1
openssl-3.0.2
openssl-3.0.3
openssl-3.0.4
openssl-3.0.5
openssl-3.0.6
openssl-3.0.7