NVD - CVE-2023-0286 (original) (raw)
CVE-2023-0286 Detail
Current Description
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
Analysis Description
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
Metrics
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:
NIST: NVD
N/A
NVD assessment not yet provided.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base Score: 7.4 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
ADP: CISA-ADP
Base Score: 7.4 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0 Severity and Vector Strings:
NIST: NVD
Base Score: N/A
NVD assessment not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt | CVE, OpenSSL Software Foundation | Third Party Advisory |
| https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig | CVE, OpenSSL Software Foundation | Third Party Advisory |
| https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 | CVE, OpenSSL Software Foundation | Patch Vendor Advisory |
| https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658 | CVE, OpenSSL Software Foundation | Patch Vendor Advisory |
| https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d | CVE, OpenSSL Software Foundation | Patch Vendor Advisory |
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003 | CVE | |
| https://security.gentoo.org/glsa/202402-08 | CVE, OpenSSL Software Foundation | |
| https://www.openssl.org/news/secadv/20230207.txt | CVE, OpenSSL Software Foundation | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | NIST CISA-ADP |
Known Affected Software Configurations Switch to CPE 2.2
CPEs loading, please wait.
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
14 change records found show changes
CVE Modified by CISA-ADP 6/17/2026 1:25:12 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | SSVC | {"timestamp":"2025-03-06T15:57:22.031399Z","id":"CVE-2023-0286","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"} |
CVE Modified by OpenSSL Software Foundation 6/17/2026 1:25:12 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Affected | [{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"3.0.0","lessThan":"3.0.8","versionType":"semver","status":"affected"},{"version":"1.1.1","lessThan":"1.1.1t","versionType":"custom","status":"affected"},{"version":"1.0.2","lessThan":"1.0.2zg","versionType":"custom","status":"affected"}]}] |
CVE Modified by CVE 11/04/2025 3:16:16 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003 |
CVE Modified by CISA-ADP 3/20/2025 5:15:16 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CVSS V3.1 | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H | |
| Added | CWE | CWE-843 |
CVE Modified by OpenSSL Software Foundation 2/13/2025 12:15:54 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | Description | There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. | There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. |
CVE Modified by CVE 11/21/2024 2:36:53 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt | |
| Added | Reference | https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018\_x509.patch.sig | |
| Added | Reference | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 | |
| Added | Reference | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658 | |
| Added | Reference | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d | |
| Added | Reference | https://security.gentoo.org/glsa/202402-08 | |
| Added | Reference | https://www.openssl.org/news/secadv/20230207.txt |
CVE Modified by OpenSSL Software Foundation 5/14/2024 7:58:28 AM
| Action | Type | Old Value | New Value |
|---|
CVE Modified by OpenSSL Software Foundation 2/04/2024 4:15:09 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | OpenSSL Software Foundation https://security.gentoo.org/glsa/202402-08 [No types assigned] |
CVE Modified by OpenSSL Software Foundation 11/06/2023 11:00:05 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | Description | There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. | There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. |
Modified Analysis by NIST 7/18/2023 8:54:18 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CPE Configuration | OR *cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:* versions up to (excluding) 3.3.3 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 2.7.0 up to (excluding) 2.7.11 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 2.8.0 up to (excluding) 3.7.34 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 3.8.0 up to (excluding) 3.11.22 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.3.16 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 4.4.0 up to (excluding) 4.6.3 | |
| Changed | Reference Type | https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt No Types Assigned | https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt Third Party Advisory |
| Changed | Reference Type | https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018\_x509.patch.sig No Types Assigned | https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018\_x509.patch.sig Third Party Advisory |
| Changed | Reference Type | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 No Types Assigned | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 Patch, Vendor Advisory |
| Changed | Reference Type | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658 No Types Assigned | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658 Patch, Vendor Advisory |
| Changed | Reference Type | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d No Types Assigned | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d Patch, Vendor Advisory |
CVE Modified by OpenSSL Software Foundation 3/27/2023 3:15:09 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt [No Types Assigned] | |
| Added | Reference | https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018\_x509.patch.sig [No Types Assigned] |
CVE Modified by OpenSSL Software Foundation 2/24/2023 10:15:12 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 [No Types Assigned] | |
| Added | Reference | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658 [No Types Assigned] | |
| Added | Reference | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d [No Types Assigned] |
Reanalysis by NIST 2/21/2023 2:40:56 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CVSS V3.1 | NIST AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H | |
| Removed | CVSS V3.1 | NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Initial Analysis by NIST 2/18/2023 4:48:38 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CVSS V3.1 | NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H | |
| Added | CWE | NIST CWE-843 | |
| Added | CPE Configuration | OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (excluding) 1.0.2zg *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (excluding) 1.1.1t *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.8 | |
| Changed | Reference Type | https://www.openssl.org/news/secadv/20230207.txt No Types Assigned | https://www.openssl.org/news/secadv/20230207.txt Vendor Advisory |
Quick Info
CVE Dictionary Entry:
CVE-2023-0286
NVD Published Date:
02/08/2023
NVD Last Modified:
06/17/2026
Source:
OpenSSL Software Foundation