Possible DoS translating ASN.1 object identifiers

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2023-2650
StatePUBLISHED
Assigneropenssl
Source PriorityCVE Program / NVD first with legacy fallback
Published2023-05-30 14:15:09 UTC
Updated2026-10-14 21:17:15 UTC
DescriptionIssue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low.

Risk And Classification

Primary CVSS: v3.1 6.5 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Problem Types: CWE-770 | inefficient algorithmic complexity | CWE-770 CWE-770 Allocation of Resources Without Limits or Throttling

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary6.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
3.1ADPDECLARED6.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
3.1134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary6.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Openssl Openssl All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA OpenSSL OpenSSL affected 3.1.1 3.1.1 semver Not specified
CNA OpenSSL OpenSSL affected 3.0.0 3.0.9 semver Not specified
CNA OpenSSL OpenSSL affected 1.1.1 1.1.1u custom Not specified
CNA OpenSSL OpenSSL affected 1.0.2 1.0.2zh custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified
ADP Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified

References

ReferenceSourceLinkTags
cert-portal.siemens.com/productcert/html/ssa-398330.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e cert-portal.siemens.com
Debian -- Security Information -- DSA-5417-1 openssl af854a3a-2127-422b-91ae-364da2661108 www.debian.org Third Party Advisory
October 2023 MySQL Server Vulnerabilities in NetApp Products | NetApp Product Security af854a3a-2127-422b-91ae-364da2661108 security.netapp.com
Security Advisory af854a3a-2127-422b-91ae-364da2661108 psirt.global.sonicwall.com Third Party Advisory
403 Forbidden af854a3a-2127-422b-91ae-364da2661108 security.netapp.com Third Party Advisory
www.openssl.org/news/secadv/20230530.txt af854a3a-2127-422b-91ae-364da2661108 www.openssl.org Vendor Advisory
[SECURITY] [DLA 3449-1] openssl security update af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
git.openssl.org Git - openssl.git/commitdiff af854a3a-2127-422b-91ae-364da2661108 git.openssl.org Mailing List, Patch
OpenSSL: Multiple Vulnerabilities (GLSA 202402-08) — Gentoo security af854a3a-2127-422b-91ae-364da2661108 security.gentoo.org
git.openssl.org Git - openssl.git/commitdiff af854a3a-2127-422b-91ae-364da2661108 git.openssl.org Mailing List, Patch
oss-security - OpenSSL Security Advisory af854a3a-2127-422b-91ae-364da2661108 www.openwall.com Mailing List
git.openssl.org Git - openssl.git/commitdiff af854a3a-2127-422b-91ae-364da2661108 git.openssl.org Broken Link
cert-portal.siemens.com/productcert/html/ssa-699386.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e cert-portal.siemens.com
cert-portal.siemens.com/productcert/html/ssa-943925.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e cert-portal.siemens.com
git.openssl.org Git - openssl.git/commitdiff af854a3a-2127-422b-91ae-364da2661108 git.openssl.org Mailing List, Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: OSSFuzz (en)

CNA: Matt Caswell (en)

CNA: Richard Levitte (en)

Legacy QID Mappings

  • 160752 Oracle Enterprise Linux Security Update for Open Secure Sockets Layer (OpenSSL) (ELSA-2023-3722)
  • 161096 Oracle Enterprise Linux Security Update for edk2 (ELSA-2023-6330)
  • 181818 Debian Security Update for Open Secure Sockets Layer (OpenSSL) (DSA 5417-1)
  • 181834 Debian Security Update for Open Secure Sockets Layer (OpenSSL) (DLA 3449-1)
  • 183591 Debian Security Update for Open Secure Sockets Layer (OpenSSL) (CVE-2023-2650)
  • 199379 Ubuntu Security Notification for Open Secure Sockets Layer (OpenSSL) Vulnerabilities (USN-6119-1)
  • 199503 Ubuntu Security Notification for Open Secure Sockets Layer (OpenSSL) Vulnerability (USN-6188-1)
  • 200161 Ubuntu Security Notification for Node.js Vulnerabilities (USN-6672-1)
  • 20369 Oracle MySQL OCT 2023 Critical Patch Update (CPUOCT2023)
  • 241736 Red Hat Update for Open Secure Sockets Layer (OpenSSL) (RHSA-2023:3722)
  • 242308 Red Hat Update for edk2 security (RHSA-2023:6330)
  • 242553 Red Hat Update for JBoss Core Services (RHSA-2023:7625)
  • 330149 IBM Advanced Interactive eXecutive (AIX) Open Secure Sockets Layer (OpenSSL) Multiple Vulnerabilities (openssl_advisory39)
  • 355387 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : ALAS2-2023-2073
  • 355428 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : ALAS-2023-1762
  • 355470 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : ALAS2023-2023-222
  • 355523 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : AL2012-2023-422
  • 355550 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL)11 : ALAS2-2023-2097
  • 356233 Amazon Linux Security Advisory for openssl-snapsafe : ALASOPENSSL-SNAPSAFE-2023-002
  • 356483 Amazon Linux Security Advisory for openssl-snapsafe : ALAS2OPENSSL-SNAPSAFE-2023-002
  • 357333 Amazon Linux Security Advisory for edk2 : ALAS2-2024-2502
  • 378948 Oracle Hypertext Transfer Protocol (HTTP) Server Multiple Vulnerabilities (CPUOCT2023)
  • 379141 SolarWinds Serv-U HTML Injection Vulnerability
  • 503023 Alpine Linux Security Update for Open Secure Sockets Layer (OpenSSL)
  • 503024 Alpine Linux Security Update for Open Secure Sockets Layer3 (OpenSSL3)
  • 503025 Alpine Linux Security Update for Open Secure Sockets Layer (OpenSSL)
  • 503121 Alpine Linux Security Update for openssl
  • 505906 Alpine Linux Security Update for openssl
  • 673266 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2023-2593)
  • 673271 EulerOS Security Update for shim (EulerOS-SA-2023-2598)
  • 673297 EulerOS Security Update for shim (EulerOS-SA-2023-2628)
  • 673308 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2023-2623)
  • 673357 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2023-2835)
  • 673365 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2023-3141)
  • 673366 EulerOS Security Update for shim (EulerOS-SA-2023-2801)
  • 673398 EulerOS Security Update for linux-sgx (EulerOS-SA-2023-3047)
  • 673410 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2023-2830)
  • 673487 EulerOS Security Update for shim (EulerOS-SA-2023-2831)
  • 673596 EulerOS Security Update for compat-openssl10 (EulerOS-SA-2023-3117)
  • 673724 EulerOS Security Update for shim (EulerOS-SA-2024-1299)
  • 674010 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2023-2793)
  • 674017 EulerOS Security Update for shim (EulerOS-SA-2023-2836)
  • 674047 EulerOS Security Update for shim (EulerOS-SA-2023-2825)
  • 674048 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2023-2817)
  • 691177 Free Berkeley Software Distribution (FreeBSD) Security Update for Open Secure Sockets Layer (OpenSSL) (eb9a3c57-ff9e-11ed-a0d1-84a93843eb75)
  • 691183 Free Berkeley Software Distribution (FreeBSD) Security Update for python (d86becfe-05a4-11ee-9d4a-080027eda32c)
  • 691336 Free Berkeley Software Distribution (FreeBSD) Security Update for mysql (22df5074-71cd-11ee-85eb-84a93843eb75)
  • 710857 Gentoo Linux Open Secure Sockets Layer (OpenSSL) Multiple Vulnerabilities (GLSA 202402-08)
  • 730953 Hewlett Packard Enterprise (HPE) OneView Multiple Vulnerabilities
  • 754048 SUSE Enterprise Linux Security Update for Open Secure Sockets Layer-1_0_0 (OpenSSL1_0_0)(SUSE-SU-2023:2331-1)
  • 754049 SUSE Enterprise Linux Security Update for Open Secure Sockets Layer-1_0_0 (OpenSSL-1_0_0) (SUSE-SU-2023:2330-1)
  • 754050 SUSE Enterprise Linux Security Update for compat-openssl098 (SUSE-SU-2023:2329-1)
  • 754051 SUSE Enterprise Linux Security Update for Open Secure Sockets Layer-1_1 (OpenSSL-1_1 ) (SUSE-SU-2023:2328-1)
  • 754052 SUSE Enterprise Linux Security Update for Open Secure Sockets Layer-1_1 (OpenSSL-1_1) (SUSE-SU-2023:2327-1)
  • 754064 SUSE Enterprise Linux Security Update for openssl-1_1 (SUSE-SU-2023:2343-1)
  • 906953 Common Base Linux Mariner (CBL-Mariner) Security Update for kata-containers-cc (27009-1)
  • 907009 Common Base Linux Mariner (CBL-Mariner) Security Update for Open Secure Sockets Layer (OpenSSL) (26979-1)
  • 907024 Common Base Linux Mariner (CBL-Mariner) Security Update for Open Secure Sockets Layer (OpenSSL) (26984-1)
  • 907591 Common Base Linux Mariner (CBL-Mariner) Security Update for edk2 (31144-1)
  • 941150 AlmaLinux Security Update for Open Secure Sockets Layer (OpenSSL) (ALSA-2023:3722)
  • 941346 AlmaLinux Security Update for edk2 (ALSA-2023:6330)

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report