CVE-2023-0216

Katalog CVE

CVSS 7.5 · High EPSS 1,8%

Kerentanan NULL Pointer Dereference pada openssl, stormshield management center. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.

Rincian

Terbit di NVD

8 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6 patch · advisory vendor
• https://www.openssl.org/news/secadv/20230207.txt advisory vendor
• https://security.gentoo.org/glsa/202402-08
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003