There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName
Why It Matters
Analysis dossierWhy It Matters
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
High
Unknown
Unknown
Risk basis: SOC ecosystem technology relevance; HIGH severity; No confirmed exploitation signal in current enrichment
Affected Products & Remediation
3 source-backed products- openssl openssl · >= 1.0.2 < 1.0.2zg; >= 1.1.1 < 1.1.1t; >= 3.0.0 < 3.0.8 · NVD CPE · Source
- stormshield stormshield management center · < 3.3.3 · NVD CPE · Source
- stormshield stormshield network security · >= 2.7.0 < 2.7.11; >= 2.8.0 < 3.7.34; >= 3.8.0 < 3.11.22; >= 4.0.0 < 4.3.16; >= 4.4.0 < 4.6.3 · NVD CPE · Source
Vendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched network-unauthenticated (CVSS AV:N, CVSS PR:N, CVSS UI:N)
Exposure
- Identify devices reporting this CVE and note which expose the affected service to untrusted networks.Telemetry: DeviceTvmSoftwareVulnerabilities · A network-reachable, no-privilege vector makes internet-facing instances the first exposure question. · Rule network-unauthenticated
Exploitation evidence
- Review inbound connections to the affected service from unexpected sources since the advisory date.Telemetry: DeviceNetworkEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule network-unauthenticated
Response
- Confirm the source-stated update is installed and the CVE is no longer reported.Telemetry: DeviceTvmSoftwareVulnerabilities · A follow-up inventory check verifies remediation. · Rule network-unauthenticated
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- openssl-security@openssl.org
- Record status · verification
- UPDATED · NVD API
- CPE
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*, cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*, cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2023-0286"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descCorrelated briefings
— No published briefing references this CVE