CVE-2023-3817
- Source
- https://cve.org/CVERecord?id=CVE-2023-3817
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3817.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-3817
- Downstream
ALPINE (1)
BELL (1)
CGA (6)
CLEANSTART (2)
CLSA (5)
DEBIAN (1)
JLSEC (1)
MGASA (2)
OESA (1)
RHSA (7)
RLSA (1)
SUSE (14)
- Related
- Published
- 2023-07-31T15:34:13Z
- Modified
- 2026-10-21T02:49:53Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- Excessive time spent checking DH q parameter value
- Details
-
Issue summary: Checking excessively long DH keys or parameters may be very slow.
Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.
The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.
An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.
The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().
Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option.
The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
- Database specific
{ "cna_assigner": "openssl", "cwe_ids": [ "CWE-606" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3817.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "3.1.0" }, { "fixed": "3.1.2" }, { "introduced": "3.0.0" }, { "fixed": "3.0.10" }, { "introduced": "1.1.1" }, { "fixed": "1.1.1v" }, { "introduced": "1.0.2" }, { "fixed": "1.0.2zi" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
-
- http://seclists.org/fulldisclosure/2023/Jul/43
- http://www.openwall.com/lists/oss-security/2023/07/31/1
- http://www.openwall.com/lists/oss-security/2023/09/22/11
- http://www.openwall.com/lists/oss-security/2023/09/22/9
- http://www.openwall.com/lists/oss-security/2023/11/06/2
- https://cert-portal.siemens.com/productcert/html/ssa-099606.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-915275.html
- https://cert-portal.siemens.com/productcert/html/ssa-943925.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3817.json
- https://nvd.nist.gov/vuln/detail/CVE-2023-3817
- https://security.gentoo.org/glsa/202402-08
- https://security.netapp.com/advisory/ntap-20230818-0014/
- https://security.netapp.com/advisory/ntap-20231027-0008/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.openssl.org/news/secadv/20230731.txt
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5
Affected packages
Git / github.com/openssl/openssl
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openssl/openssl
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0" }, { "fixed": "3.0.10" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.0" }, { "fixed": "3.1.2" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2:-:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2-NA" }, { "last_affected": "1.0.2-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2a" }, { "last_affected": "1.0.2a" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2b" }, { "last_affected": "1.0.2b" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2c" }, { "last_affected": "1.0.2c" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2d" }, { "last_affected": "1.0.2d" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2e" }, { "last_affected": "1.0.2e" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2f" }, { "last_affected": "1.0.2f" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2g" }, { "last_affected": "1.0.2g" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2h" }, { "last_affected": "1.0.2h" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2i" }, { "last_affected": "1.0.2i" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2j" }, { "last_affected": "1.0.2j" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2k" }, { "last_affected": "1.0.2k" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2l" }, { "last_affected": "1.0.2l" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2m" }, { "last_affected": "1.0.2m" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2n:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2n" }, { "last_affected": "1.0.2n" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2o:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2o" }, { "last_affected": "1.0.2o" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2p:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2p" }, { "last_affected": "1.0.2p" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2q:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2q" }, { "last_affected": "1.0.2q" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2r:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2r" }, { "last_affected": "1.0.2r" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2s:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2s" }, { "last_affected": "1.0.2s" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2t:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2t" }, { "last_affected": "1.0.2t" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2u:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2u" }, { "last_affected": "1.0.2u" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2v:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2v" }, { "last_affected": "1.0.2v" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2w:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2w" }, { "last_affected": "1.0.2w" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2x:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2x" }, { "last_affected": "1.0.2x" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2y:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2y" }, { "last_affected": "1.0.2y" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2za:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2za" }, { "last_affected": "1.0.2za" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2zb:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2zb" }, { "last_affected": "1.0.2zb" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2zc:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2zc" }, { "last_affected": "1.0.2zc" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2zd:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2zd" }, { "last_affected": "1.0.2zd" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2ze:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2ze" }, { "last_affected": "1.0.2ze" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2zf:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2zf" }, { "last_affected": "1.0.2zf" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2zg:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2zg" }, { "last_affected": "1.0.2zg" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2zh:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2zh" }, { "last_affected": "1.0.2zh" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2-beta1" }, { "last_affected": "1.0.2-beta1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2-beta2" }, { "last_affected": "1.0.2-beta2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2-beta3" }, { "last_affected": "1.0.2-beta3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:-:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-NA" }, { "last_affected": "1.1.1-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1a:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1a" }, { "last_affected": "1.1.1a" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1b:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1b" }, { "last_affected": "1.1.1b" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1c:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1c" }, { "last_affected": "1.1.1c" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1d:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1d" }, { "last_affected": "1.1.1d" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1e:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1e" }, { "last_affected": "1.1.1e" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1f:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1f" }, { "last_affected": "1.1.1f" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1g:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1g" }, { "last_affected": "1.1.1g" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1h:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1h" }, { "last_affected": "1.1.1h" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1i:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1i" }, { "last_affected": "1.1.1i" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1j:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1j" }, { "last_affected": "1.1.1j" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1k" }, { "last_affected": "1.1.1k" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1l:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1l" }, { "last_affected": "1.1.1l" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1m:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1m" }, { "last_affected": "1.1.1m" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1n:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1n" }, { "last_affected": "1.1.1n" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1o:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1o" }, { "last_affected": "1.1.1o" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1p:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1p" }, { "last_affected": "1.1.1p" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1q" }, { "last_affected": "1.1.1q" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1r:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1r" }, { "last_affected": "1.1.1r" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1s:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1s" }, { "last_affected": "1.1.1s" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1t:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1t" }, { "last_affected": "1.1.1t" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1u:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1u" }, { "last_affected": "1.1.1u" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:pre1:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-pre1" }, { "last_affected": "1.1.1-pre1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:pre2:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-pre2" }, { "last_affected": "1.1.1-pre2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:pre3:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-pre3" }, { "last_affected": "1.1.1-pre3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:pre4:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-pre4" }, { "last_affected": "1.1.1-pre4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:pre5:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-pre5" }, { "last_affected": "1.1.1-pre5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:pre6:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-pre6" }, { "last_affected": "1.1.1-pre6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:pre7:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-pre7" }, { "last_affected": "1.1.1-pre7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:pre8:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-pre8" }, { "last_affected": "1.1.1-pre8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.1:pre9:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1-pre9" }, { "last_affected": "1.1.1-pre9" } ], "source": "CPE_STRING" } ] }
Affected versions
1.*
1.0.2-NA
1.0.2-beta1
1.0.2-beta2
1.0.2-beta3
1.1.1-NA
1.1.1-pre1
1.1.1-pre2
1.1.1-pre3
1.1.1-pre4
1.1.1-pre5
1.1.1-pre6
1.1.1-pre7
1.1.1-pre8
1.1.1-pre9
openssl-3.*
openssl-3.0.0
openssl-3.0.1
openssl-3.0.2
openssl-3.0.3
openssl-3.0.4
openssl-3.0.5
openssl-3.0.6
openssl-3.0.7
openssl-3.0.8
openssl-3.0.9
openssl-3.1.0
openssl-3.1.1