Skip to content

openssl CVE-2023-0286

High
bcressey published GHSA-39pw-7vg4-968r Mar 13, 2023

Package

openssl (bottlerocket-test-system)

Affected versions

< 0.0.6

Patched versions

0.0.6

Description

When reading X.509 certificates and parsing the X.400 address, OpenSSL incorrectly assumes the type of the incoming X.400 address. This type confusion could lead malicious actors to provide arbitrary memory addresses in the X.400 field allowing them to read or extract memory contents. This also can lead to unexpected crashes of agents and clients compiled with OpenSSL as the malicious payload may contain addresses that have already been freed.

Severity

High

CVE ID

CVE-2023-0286

Weaknesses

No CWEs