openssl: Denial of service by excessive resource usage in verifying X509 policy constraints

🗓️ 07 Dec 2023 13:55:16Reported by RedHatType

redhat🔗 access.redhat.com👁 5 Views

OpenSSL DoS in X509 chain verification from policy constraints; crafted chains exhaust resources.

Reporter	Title	Published	Views	Family All 374
IBM Security Bulletins	Security Bulletin: IBM Watson Explorer affected by vulnerability in OpenSSL	30 Jun 202313:51	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities were identified in IBM Security Verify Access.	17 Jan 202415:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.0.25 addresses multiple vulnerabilities	24 Nov 202313:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities	24 Jul 202317:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related OpenSSL	6 Oct 202307:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Conductor openssl 1.1.1 End of Life	5 Oct 202320:31	–	ibm
IBM Security Bulletins	Security Bulletin: OpenSSL publicly disclosed vulnerabilities affect IBM® MobileFirst Platform	8 Aug 202310:37	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2023-0464 may affect IBM CICS TX Advanced 10.1	8 Jun 202318:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	26 Feb 202419:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Master Data Management is vulnerable to specially crafted certificate chains in OpenSSL leading to a denial of service (CVE-2023-0464)	25 Oct 202420:40	–	ibm

Vulners

Node

AND

redhat jboss_core_servicesRange<1

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-0464
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-0464
cve	www.cve.org/CVERecord
openssl	www.openssl.org/news/secadv/20230322.txt

11 Aug 2026 20:33Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.03658

SSVC

OpenSSL certificate policy policy constraints certificate chain resource exhaustion denial of service