CVE-2023-0286

Aliases:GHSA-x4qr-2fvf-3mr5RUSTSEC-2023-0006
Advisory lineage Upstream: 0 Downstream: 60
Modified
Published: 08 Feb 2023, 19:01
Last modified:04 Nov 2025, 19:14

Vulnerability Summary

Overall Risk (default)
medium
47/100
CVSS Score
7.4 HIGH
v3.1 (cve.org)
EPSS Score
88.33% CRITICAL
88% probability -0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Feb 2023, 19:01
Published
Vulnerability first disclosed
04 Nov 2025, 19:14
Last Modified
Vulnerability information updated

Description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

CVSS Metrics

  • v3.1•HIGH•Score: 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Trends

Current EPSS score: 88.33%• Percentile: 100%

Techniques & Countermeasures

  • CWE-843•Access of Resource Using Incompatible Type ('Type Confusion')

    The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Affected Systems

  • Crates.Io•openssl-src

    < 111.25.0 | ≥ 300.0.0, < 300.0.12

  • Unknown•OpenSSL

    ≥ 1.0.2, < 1.0.2zg | ≥ 1.1.1, < 1.1.1t | ≥ 3.0.0, < 3.0.8

  • PyPI•cryptography

    ≥ 0.8.1, < 39.0.1

  • stormshield•stormshield_management_center

    < 3.3.3

  • stormshield•stormshield network security

    ≥ 2.7.0, < 2.7.11 | ≥ 2.8.0, < 3.7.34 | ≥ 3.8.0, < 3.11.22 | ≥ 4.0.0, < 4.3.16 | ≥ 4.4.0, < 4.6.3

References (14)