A vulnerability has been found in OpenSSL up to 3.0.14/3.1.6/3.2.2/3.3.1 (Network Encryption Software) and classified as problematic.The CWE definition forthe vulnerability is CWE-843. Theproduct allocates or initializes a resource such asa pointer, object, or variable using one type, butit later accesses thatresource using a type that is incompatible with the original type.Asan impact it is known to affect availability.Upgrading to version 3.0.15,3.1.7, 3.2.3or 3.3.2 eliminates thisvulnerability. Applying thepatch 06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6 is able toeliminate this problem. The bugfix is readyfor download at github.com. The best possible mitigation issuggested to beupgrading to the latest version.
Issue summary: Applications performing certificate name checks (e.g., TLSclients checking server certificates) may attempt to read an invalid memoryaddressresulting in abnormal terminationof the application process.Impact summary: Abnormaltermination of an application can a cause a denialofservice.Applicationsperforming certificate name checks (e.g., TLS clients checkingservercertificates) may attempt to read an invalid memory address whencomparingthe expectedname with an `otherName`subject alternative name ofanX.509 certificate. This may result in an exception thatterminates theapplication program.Note thatbasic certificate chain validation (signatures, dates, ...)is notaffected,the denial of service can occur only when the application alsospecifies an expected DNS name, Email address or IP address.TLS servers rarely solicit client certificates, and even when they do, theygenerally don t perform a name check against a reference identifier (expectedidentity), but rather extract the presented identity after checking thecertificate chain. So TLS servers are generally not affected and the severityof the issue is Moderate.The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Issue summary: Applications performing certificate name checks (e.g., TLSclients checking server certificates) may attempt to read an invalid memoryaddress resulting in abnormal termination of the application process.Impact summary: Abnormal termination of an application can a cause a denial ofservice.Applications performing certificate name checks (e.g., TLS clients checkingserver certificates) may attempt to read an invalid memory address whencomparing the expected name with an `otherName` subject alternative name of anX.509 certificate. This may result in an exception that terminates theapplication program.Note that basic certificate chain validation (signatures, dates, ...) is notaffected, the denial of service can occur only when the application alsospecifies an expected DNS name, Email address or IP address.TLS servers rarely solicit client certificates, and even when they do, theygenerally don t perform a name check against a reference identifier (expectedidentity), but rather extract the presented identity after checking thecertificate chain. So TLS servers are generally not affected and the severityof the issue is Moderate.The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Issue summary: Applications performing certificate name checks (e.g., TLSclients checking server certificates) may attempt to read an invalid memoryaddress resulting in abnormal termination of the application process.Impact summary: Abnormal termination of an application can a cause a denial ofservice.Applications performing certificate name checks (e.g., TLS clients checkingserver certificates) may attempt to read an invalid memory address whencomparing the expected name with an `otherName` subject alternative name of anX.509 certificate. This may result in an exception that terminates theapplication program.Note that basic certificate chain validation (signatures, dates, ...) is notaffected, the denial of service can occur only when the application alsospecifies an expected DNS name, Email address or IP address.TLS servers rarely solicit client certificates, and even when they do, theygenerally don t perform a name check against a reference identifier (expectedidentity), but rather extract the presented identity after checking thecertificate chain. So TLS servers are generally not affected and the severityof the issue is Moderate.The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Issue summary: Applications performing certificate name checks (e.g., TLSclients checking server certificates) may attempt to read an invalid memoryaddress resulting in abnormal termination of the application process.Impact summary: Abnormal termination of an application can a cause a denial ofservice.Applications performing certificate name checks (e.g., TLS clients checkingserver certificates) may attempt to read an invalid memory address whencomparing the expected name with an `otherName` subject alternative name of anX.509 certificate. This may result in an exception that terminates theapplication program.Note that basic certificate chain validation (signatures, dates, ...) is notaffected, the denial of service can occur only when the application alsospecifies an expected DNS name, Email address or IP address.TLS servers rarely solicit client certificates, and even when they do, theygenerally don t perform a name check against a reference identifier (expectedidentity), but rather extract the presented identity after checking thecertificate chain. So TLS servers are generally not affected and the severityof the issue is Moderate.The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Issue summary: Applications performing certificate name checks (e.g., TLSclients checking server certificates) may attempt to read an invalid memoryaddress resulting in abnormal termination of the application process.Impact summary: Abnormal termination of an application can a cause a denial ofservice.Applications performing certificate name checks (e.g., TLS clients checkingserver certificates) may attempt to read an invalid memory address whencomparing the expected name with an `otherName` subject alternative name of anX.509 certificate. This may result in an exception that terminates theapplication program.Note that basic certificate chain validation (signatures, dates, ...) is notaffected, the denial of service can occur only when the application alsospecifies an expected DNS name, Email address or IP address.TLS servers rarely solicit client certificates, and even when they do, theygenerally don t perform a name check against a reference identifier (expectedidentity), but rather extract the presented identity after checking thecertificate chain. So TLS servers are generally not affected and the severityof the issue is Moderate.The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
