Issue summary: Checking excessively long DH keys or parameters may be very slow.
Impact summary: Applications that use the functions DH_check(), DH_check_ex()
or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long
delays. Where the key or parameters that are being checked have been obtained
from an untrusted source this may lead to a Denial of Service.
The function DH_check() performs various checks on DH parameters. After fixing
CVE-2023-3446 it was discovered that a large q parameter value can also trigger
an overly long computation during some of these checks. A correct q value,
if present, cannot be larger than the modulus p parameter, thus it is
unnecessary to perform these checks if q is larger than p.
An application that calls DH_check() and supplies a key or parameters obtained
from an untrusted source could be vulnerable to a Denial of Service attack.
The function DH_check() is itself called by a number of other OpenSSL functions.
An application calling any of those other functions may similarly be affected.
The other functions affected by this are DH_check_ex() and
EVP_PKEY_param_check().
Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications
when using the "-check" option.
The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5 - Mailing List, Patch | |
| References | () https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644 - Broken Link | |
| References | () https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f - Mailing List, Patch | |
| References | () https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5 - Mailing List, Patch | |
| References | () https://www.openssl.org/news/secadv/20230731.txt - Vendor Advisory |
14 Oct 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-606 | |
| References |
|
21 Jun 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Feb 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2023-07-31 16:15
Updated : 2025-05-05 16:15
NVD link : CVE-2023-3817
Mitre link : CVE-2023-3817
CVE.ORG link : CVE-2023-3817
JSON object : View
Products Affected
openssl
- openssl