CVE-2023-0286
📋 TL;DR
CVE-2023-0286 is a type confusion vulnerability in OpenSSL's X.400 address processing that can cause memory corruption when CRL checking is enabled. Attackers can potentially read memory contents or cause denial of service by providing specially crafted certificates and CRLs. This primarily affects applications that implement custom CRL retrieval functionality over networks.
💻 Affected Systems
- OpenSSL
- LibreSSL
- applications using vulnerable OpenSSL versions
📦 What is this software?
Openssl by Openssl
OpenSSL is a robust, commercial-grade toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is one of the most widely used libraries for implementing secure communications in applications worldwide.
Learn more about Openssl →Openssl by Openssl
OpenSSL is a robust, commercial-grade toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is one of the most widely used libraries for implementing secure communications in applications worldwide.
Learn more about Openssl →Openssl by Openssl
OpenSSL is a robust, commercial-grade toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is one of the most widely used libraries for implementing secure communications in applications worldwide.
Learn more about Openssl →Stormshield Management Center by Stormshield
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution or sensitive information disclosure from process memory
Likely Case
Denial of service through application crashes or memory corruption without code execution
If Mitigated
No impact if CRL checking is disabled or proper input validation is implemented
🎯 Exploit Status
Exploitation requires attacker to provide both certificate chain and CRL with X.400 addresses, or control one input while the other already contains X.400 address as CRL distribution point
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenSSL 3.0.8, 1.1.1u, LibreSSL 3.6.2
Vendor Advisory: https://www.openssl.org/news/secadv/20230207.txt
Restart Required: Yes
Instructions:
1. Identify OpenSSL/LibreSSL version. 2. Update to patched version via package manager (apt-get upgrade openssl, yum update openssl, etc.). 3. Restart affected services. 4. Recompile statically linked applications with updated libraries.
🔧 Temporary Workarounds
Disable CRL checking
allDisable certificate revocation list checking in application configuration
Set X509_V_FLAG_CRL_CHECK to 0 in application code
Input validation
allReject certificates/CRLs containing X.400 addresses in CRL distribution points
Implement certificate validation to filter X.400 addresses
🧯 If You Can't Patch
- Disable CRL checking functionality in all affected applications
- Implement network segmentation to restrict access to CRL retrieval endpoints
🔍 How to Verify
Check if Vulnerable:
Check OpenSSL version with 'openssl version' and verify if between affected ranges (3.0.0-3.0.7 or 1.1.1-1.1.1t)Check Version:
openssl versionVerify Fix Applied:
Verify version is 3.0.8+, 1.1.1u+, or LibreSSL 3.6.2+ with 'openssl version'📡 Detection & Monitoring
Log Indicators:
- Application crashes related to certificate validation
- Memory access violation errors in OpenSSL context
- Unexpected certificate parsing failures
Network Indicators:
- Unusual CRL retrieval patterns
- Multiple certificate validation requests with X.400 addresses
SIEM Query:
source="*ssl*" AND ("certificate validation" OR "CRL" OR "X.400") AND (error OR crash OR violation)🔗 References
- https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d
- https://security.gentoo.org/glsa/202402-08
- https://www.openssl.org/news/secadv/20230207.txt
- https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003
- https://security.gentoo.org/glsa/202402-08
- https://www.openssl.org/news/secadv/20230207.txt
