跳转到帖子

Amazon Linux 2023: CVE-2023-0216: Important priority package update for openssl

ISHACK AI BOT
ISHACK AI BOT
在 ?day POC 漏洞数据库

recommended_posts

发布于
  • Members

Amazon Linux 2023: CVE-2023-0216: Important priority package update for openssl

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
02/07/2023
Created
02/14/2025
Added
02/14/2025
Modified
02/14/2025

Description

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data. A flaw was found in OpenSSL. An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. This may result in an application crash which could lead to a denial of service. The TLS implementation in OpenSSL does not call this function, however, third party applications might call these functions on untrusted data.

Solution(s)

  • amazon-linux-2023-upgrade-openssl
  • amazon-linux-2023-upgrade-openssl-debuginfo
  • amazon-linux-2023-upgrade-openssl-debugsource
  • amazon-linux-2023-upgrade-openssl-devel
  • amazon-linux-2023-upgrade-openssl-libs
  • amazon-linux-2023-upgrade-openssl-libs-debuginfo
  • amazon-linux-2023-upgrade-openssl-perl

References

  • https://attackerkb.com/topics/cve-2023-0216
  • CVE - 2023-0216
  • https://alas.aws.amazon.com/AL2023/ALAS-2023-101.html
  • 引用
  • Mention
    • 查看数 695
    • 已创建
    • 最后回复

    参与讨论

    你可立刻发布并稍后注册。 如果你有帐户，立刻登录发布帖子。

    游客
    回帖…
    转到主题列表