Back to bug 2164440

Who When What Removed Added
Sandipan Roy 2023-01-25 14:49:57 UTC CC security-response-team
Sandipan Roy 2023-01-25 14:51:24 UTC Blocks 2164384
Sandipan Roy 2023-01-25 14:52:08 UTC CC berrange, csutherl, ddepaula, jclere, jferlan, jwon, kraxel, mmadzin, mturk, pbonzini, peholase, pjindal, plodge, szappis
Sandipan Roy 2023-01-25 15:11:46 UTC Depends On 2164465, 2164463, 2164482, 2164447, 2164470, 2164461, 2164456, 2164476, 2164483, 2164460, 2164450, 2164454, 2164477, 2164445, 2164446, 2164448, 2164468, 2164469, 2164478, 2164452, 2164467, 2164471, 2164444, 2164453, 2164451, 2164472, 2164449, 2164474, 2164455, 2164480, 2164484, 2164458, 2164466, 2164481, 2164473, 2164464, 2164462, 2164475, 2164479, 2164457, 2164459
Sandipan Roy 2023-01-25 16:40:25 UTC Severity high medium
Priority high medium
Doc Text A type confusion vulnerability was found in the way OpenSSL processes X.400 address processing inside an X.509 GeneralName. with a specially crafted email address field. This issue could cause a server or a client application compiled with OpenSSL to crash when trying to process the malicious certificate.
Sandipan Roy 2023-01-25 17:38:58 UTC Comment 1 updated
Sandipan Roy 2023-01-25 17:40:33 UTC Depends On 2164444, 2164445, 2164446, 2164447, 2164448, 2164449, 2164450, 2164451, 2164452, 2164453, 2164454, 2164455, 2164456, 2164457, 2164458, 2164459, 2164460, 2164461, 2164462, 2164463, 2164464, 2164465, 2164466, 2164467, 2164468, 2164469, 2164470, 2164471, 2164472, 2164473, 2164474, 2164475, 2164476, 2164477, 2164478, 2164479, 2164480, 2164481, 2164482, 2164483, 2164484
Sandipan Roy 2023-01-25 17:53:02 UTC Depends On 2164527, 2164526, 2164528
Sandipan Roy 2023-01-25 17:55:57 UTC Doc Text A type confusion vulnerability was found in the way OpenSSL processes X.400 address processing inside an X.509 GeneralName. with a specially crafted email address field. This issue could cause a server or a client application compiled with OpenSSL to crash when trying to process the malicious certificate. A type confusion vulnerability was found when OpenSSL X.400 address processing inside an X.509 GeneralName. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other
input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications that have implemented their own functionality for retrieving CRLs over a network.
Sandipan Roy 2023-01-25 17:57:04 UTC Depends On 2164531, 2164533, 2164530, 2164535, 2164534, 2164532
Sandipan Roy 2023-01-25 17:57:49 UTC Depends On 2164538, 2164539, 2164537, 2164536
RaTasha Tillery-Smith 2023-01-25 18:13:17 UTC Doc Text A type confusion vulnerability was found when OpenSSL X.400 address processing inside an X.509 GeneralName. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other
input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications that have implemented their own functionality for retrieving CRLs over a network.
A type confusion vulnerability was found in OpenSSL when OpenSSL X.400 addresses processing inside an X.509 GeneralName. When CRL checking is enabled (for example, the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or cause a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, of which neither needs a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. In this case, this vulnerability is likely only to affect applications that have implemented their own functionality for retrieving CRLs over a network.
Sandipan Roy 2023-01-25 19:06:08 UTC Deadline 2023-02-07
TEJ RATHI 2023-01-27 08:56:54 UTC CC acrosby, adudiak, bdettelb, caswilli, dffrench, dfreiber, dhalasz, dkuc, drieden, fjansen, gzaronik, hbraun, hkataria, ikanias, jary, jburrell, jkoehler, jmitchel, jtanner, jwong, kaycoth, kshier, micjohns, ngough, nweather, rgodfrey, rogbas, rravi, stcannon, sthirugn, tfister, tohughes, vkrizan, vkumar, vmugicag, yguenane
Sandipan Roy 2023-02-01 14:37:01 UTC CC jwong
Depends On 2166343
Zack Miele 2023-02-07 16:59:37 UTC Group security, qe_staff
Summary EMBARGOED CVE-2023-0286 openssl: X.400 address type confusion in X.509 GeneralName CVE-2023-0286 openssl: X.400 address type confusion in X.509 GeneralName
Deadline 2023-02-07
CC bootloader-eng-team, rh-spice-bugs, virt-maint
Zack Miele 2023-02-07 17:47:46 UTC Depends On 2167871, 2167869, 2167872, 2167865, 2167879, 2167874, 2167876, 2167870, 2167866, 2167873, 2167875, 2167880, 2167877, 2167868, 2167878, 2167867
Nikita Ivanov 2023-02-10 10:00:17 UTC Flags needinfo?(saroy)
CC kesha.plovec02
Sandipan Roy 2023-02-10 10:07:25 UTC Flags needinfo?(saroy)
Sandipan Roy 2023-02-10 10:08:59 UTC Comment 10 updated
Francisco Peralta 2023-02-13 12:20:21 UTC Flags needinfo?(security-response-team)
CC fperalta
Dmitry Belyavskiy 2023-02-13 13:42:46 UTC Flags needinfo?(fperalta)
Product Security DevOps Team 2023-02-14 22:28:00 UTC Flags needinfo?(security-response-team) needinfo?(saroy)
Sandipan Roy 2023-02-15 04:49:48 UTC Flags needinfo?(saroy)
Francisco Peralta 2023-02-16 09:17:54 UTC Flags needinfo?(fperalta) needinfo?(security-response-team) needinfo?(cllang) needinfo?(dbelyavs)
Kazu Yoshida 2023-02-16 10:23:06 UTC CC kyoshida
Product Security DevOps Team 2023-02-16 15:11:19 UTC Flags needinfo?(security-response-team) needinfo?(saroy)
Sandipan Roy 2023-02-16 15:18:07 UTC Flags needinfo?(saroy)
Shreyas Mahangade 2023-02-20 03:31:45 UTC CC smahanga
Mike Ralph 2023-02-23 19:01:49 UTC CC mralph
Dmitry Belyavskiy 2023-02-23 19:06:35 UTC Flags needinfo?(dbelyavs)
Clemens Lang 2023-02-27 09:12:53 UTC Flags needinfo?(cllang)
errata-xmlrpc 2023-02-28 08:18:03 UTC Link ID Red Hat Product Errata RHSA-2023:0946
Sandra Carney 2023-03-02 21:08:16 UTC Flags needinfo?(security-response-team)
CC scarney
Product Security DevOps Team 2023-03-03 01:06:28 UTC Flags needinfo?(security-response-team) needinfo?(saroy)
Sandipan Roy 2023-03-03 04:26:40 UTC Flags needinfo?(saroy)
Sandipan Roy 2023-03-09 10:27:18 UTC Depends On 2176790
errata-xmlrpc 2023-03-14 13:52:49 UTC Link ID Red Hat Product Errata RHSA-2023:1199
Sandipan Roy 2023-03-15 14:15:10 UTC Severity medium high
Priority medium high
Sandipan Roy 2023-03-15 14:26:52 UTC Depends On 2178653, 2178674, 2178672, 2178662, 2178652, 2178658, 2178663, 2178659, 2178650, 2178671, 2178675, 2178666, 2178660, 2178668, 2178664, 2178670, 2178676, 2178673, 2178669, 2178661, 2178657, 2178654, 2178667, 2178651, 2178655, 2178665, 2178656
TEJ RATHI 2023-03-15 14:58:10 UTC Depends On 2178687
Shankar narayanan R 2023-03-16 02:12:20 UTC CC snarayanan
errata-xmlrpc 2023-03-20 09:40:02 UTC Link ID Red Hat Product Errata RHSA-2023:1335
errata-xmlrpc 2023-03-20 14:44:50 UTC Link ID Red Hat Product Errata RHBA-2023:1350
errata-xmlrpc 2023-03-20 14:45:03 UTC Link ID Red Hat Product Errata RHBA-2023:1352
Klaas Demter 2023-03-20 16:29:38 UTC CC klaas
errata-xmlrpc 2023-03-20 17:36:44 UTC Link ID Red Hat Product Errata RHBA-2023:1357
errata-xmlrpc 2023-03-21 14:43:44 UTC Link ID Red Hat Product Errata RHBA-2023:1379
errata-xmlrpc 2023-03-21 16:51:27 UTC Link ID Red Hat Product Errata RHBA-2023:1383
errata-xmlrpc 2023-03-21 16:51:34 UTC Link ID Red Hat Product Errata RHBA-2023:1382
errata-xmlrpc 2023-03-21 16:51:46 UTC Link ID Red Hat Product Errata RHBA-2023:1387
errata-xmlrpc 2023-03-21 16:51:58 UTC Link ID Red Hat Product Errata RHBA-2023:1384
errata-xmlrpc 2023-03-21 16:52:10 UTC Link ID Red Hat Product Errata RHBA-2023:1386
errata-xmlrpc 2023-03-21 17:41:06 UTC Link ID Red Hat Product Errata RHBA-2023:1388
errata-xmlrpc 2023-03-21 18:40:50 UTC Link ID Red Hat Product Errata RHBA-2023:1385
Shankar narayanan R 2023-03-22 03:59:04 UTC Flags needinfo?(klaas)
errata-xmlrpc 2023-03-22 10:33:39 UTC Link ID Red Hat Product Errata RHSA-2023:1405
errata-xmlrpc 2023-03-22 19:48:33 UTC Link ID Red Hat Product Errata RHBA-2023:1413
errata-xmlrpc 2023-03-22 19:48:40 UTC Link ID Red Hat Product Errata RHBA-2023:1414
errata-xmlrpc 2023-03-22 19:54:54 UTC Link ID Red Hat Product Errata RHBA-2023:1415
errata-xmlrpc 2023-03-22 20:44:54 UTC Link ID Red Hat Product Errata RHBA-2023:1417
errata-xmlrpc 2023-03-22 20:48:28 UTC Link ID Red Hat Product Errata RHBA-2023:1416
errata-xmlrpc 2023-03-22 20:56:33 UTC Link ID Red Hat Product Errata RHBA-2023:1418
errata-xmlrpc 2023-03-22 21:00:53 UTC Link ID Red Hat Product Errata RHBA-2023:1419
errata-xmlrpc 2023-03-22 21:25:31 UTC Link ID Red Hat Product Errata RHBA-2023:1420
errata-xmlrpc 2023-03-22 21:26:39 UTC Link ID Red Hat Product Errata RHBA-2023:1421
errata-xmlrpc 2023-03-22 21:34:44 UTC Link ID Red Hat Product Errata RHBA-2023:1422
errata-xmlrpc 2023-03-22 21:37:31 UTC Link ID Red Hat Product Errata RHBA-2023:1423
errata-xmlrpc 2023-03-22 21:38:47 UTC Link ID Red Hat Product Errata RHBA-2023:1425
errata-xmlrpc 2023-03-22 21:42:54 UTC Link ID Red Hat Product Errata RHBA-2023:1424
errata-xmlrpc 2023-03-22 21:47:23 UTC Link ID Red Hat Product Errata RHBA-2023:1426
errata-xmlrpc 2023-03-23 07:49:32 UTC Link ID Red Hat Product Errata RHBA-2023:1429
errata-xmlrpc 2023-03-23 08:53:27 UTC Link ID Red Hat Product Errata RHBA-2023:1431
errata-xmlrpc 2023-03-23 09:21:22 UTC Link ID Red Hat Product Errata RHBA-2023:1430
errata-xmlrpc 2023-03-23 10:55:53 UTC Link ID Red Hat Product Errata RHSA-2023:1437
errata-xmlrpc 2023-03-23 11:04:45 UTC Link ID Red Hat Product Errata RHSA-2023:1439
errata-xmlrpc 2023-03-23 11:05:59 UTC Link ID Red Hat Product Errata RHSA-2023:1438
errata-xmlrpc 2023-03-23 11:06:43 UTC Link ID Red Hat Product Errata RHSA-2023:1440
errata-xmlrpc 2023-03-23 11:07:35 UTC Link ID Red Hat Product Errata RHSA-2023:1441
errata-xmlrpc 2023-03-23 13:05:02 UTC Link ID Red Hat Product Errata RHBA-2023:1446
Jon Maloy 2023-03-23 15:45:11 UTC CC jmaloy
Flags needinfo?(kraxel)
Product Security DevOps Team 2023-03-23 15:46:42 UTC Status NEW CLOSED
Resolution --- ERRATA
Last Closed 2023-03-23 15:46:42 UTC
errata-xmlrpc 2023-03-23 17:47:57 UTC Link ID Red Hat Product Errata RHBA-2023:1449
errata-xmlrpc 2023-03-23 20:36:42 UTC Link ID Red Hat Product Errata RHBA-2023:1456
errata-xmlrpc 2023-03-23 20:38:11 UTC Link ID Red Hat Product Errata RHBA-2023:1457
Gerd Hoffmann 2023-03-24 12:25:31 UTC Flags needinfo?(kraxel)
errata-xmlrpc 2023-03-27 01:23:03 UTC Link ID Red Hat Product Errata RHBA-2023:1459
errata-xmlrpc 2023-03-27 06:58:58 UTC Link ID Red Hat Product Errata RHBA-2023:1460
errata-xmlrpc 2023-03-27 07:48:49 UTC Link ID Red Hat Product Errata RHBA-2023:1463
errata-xmlrpc 2023-03-27 08:02:46 UTC Link ID Red Hat Product Errata RHBA-2023:1465
errata-xmlrpc 2023-03-27 08:50:17 UTC Link ID Red Hat Product Errata RHBA-2023:1461
errata-xmlrpc 2023-03-27 09:36:10 UTC Link ID Red Hat Product Errata RHBA-2023:1473
errata-xmlrpc 2023-03-27 10:35:07 UTC Link ID Red Hat Product Errata RHBA-2023:1464
errata-xmlrpc 2023-03-27 10:36:02 UTC Link ID Red Hat Product Errata RHBA-2023:1475
errata-xmlrpc 2023-03-27 10:54:12 UTC Link ID Red Hat Product Errata RHBA-2023:1477
errata-xmlrpc 2023-03-27 11:23:53 UTC Link ID Red Hat Product Errata RHBA-2023:1476
errata-xmlrpc 2023-03-27 15:05:41 UTC Link ID Red Hat Product Errata RHBA-2023:1474
errata-xmlrpc 2023-03-27 19:58:25 UTC Link ID Red Hat Product Errata RHBA-2023:1484
errata-xmlrpc 2023-03-27 19:58:31 UTC Link ID Red Hat Product Errata RHBA-2023:1483
errata-xmlrpc 2023-03-28 04:55:54 UTC Link ID Red Hat Product Errata RHBA-2023:1485
errata-xmlrpc 2023-03-28 08:11:54 UTC Link ID Red Hat Product Errata RHBA-2023:1489
errata-xmlrpc 2023-03-28 11:36:17 UTC Link ID Red Hat Product Errata RHBA-2023:1493
errata-xmlrpc 2023-03-28 12:22:26 UTC Link ID Red Hat Product Errata RHBA-2023:1495
errata-xmlrpc 2023-03-28 14:02:01 UTC Link ID Red Hat Product Errata RHBA-2023:1497
errata-xmlrpc 2023-03-28 17:57:54 UTC Link ID Red Hat Product Errata RHBA-2023:1499
errata-xmlrpc 2023-03-28 19:04:48 UTC Link ID Red Hat Product Errata RHBA-2023:1500
errata-xmlrpc 2023-03-28 21:16:04 UTC Link ID Red Hat Product Errata RHBA-2023:1502
errata-xmlrpc 2023-03-29 12:45:56 UTC Link ID Red Hat Product Errata RHBA-2023:1520
errata-xmlrpc 2023-03-29 12:49:54 UTC Link ID Red Hat Product Errata RHBA-2023:1519
errata-xmlrpc 2023-03-29 12:59:20 UTC Link ID Red Hat Product Errata RHBA-2023:1517
errata-xmlrpc 2023-03-30 09:59:18 UTC Link ID Red Hat Product Errata RHBA-2023:1530
errata-xmlrpc 2023-03-30 12:21:17 UTC Link ID Red Hat Product Errata RHBA-2023:1532
errata-xmlrpc 2023-03-30 15:39:55 UTC Link ID Red Hat Product Errata RHBA-2023:1536
errata-xmlrpc 2023-03-30 19:40:01 UTC Link ID Red Hat Product Errata RHBA-2023:1539
errata-xmlrpc 2023-04-03 06:50:51 UTC Link ID Red Hat Product Errata RHBA-2023:1541
errata-xmlrpc 2023-04-03 06:53:02 UTC Link ID Red Hat Product Errata RHBA-2023:1542
TEJ RATHI 2023-04-03 08:01:37 UTC CC arachman, lveyde, michal.skrivanek, mperina, sbonazzo
TEJ RATHI 2023-04-03 08:18:37 UTC Depends On 2183954
errata-xmlrpc 2023-04-04 14:23:32 UTC Link ID Red Hat Product Errata RHBA-2023:1625
errata-xmlrpc 2023-04-04 15:41:48 UTC Link ID Red Hat Product Errata RHBA-2023:1626
errata-xmlrpc 2023-04-04 16:42:11 UTC Link ID Red Hat Product Errata RHBA-2023:1628
errata-xmlrpc 2023-04-04 16:48:15 UTC Link ID Red Hat Product Errata RHBA-2023:1627
errata-xmlrpc 2023-04-05 02:58:33 UTC Link ID Red Hat Product Errata RHBA-2023:1641
errata-xmlrpc 2023-04-05 12:31:02 UTC Link ID Red Hat Product Errata RHBA-2023:1654
errata-xmlrpc 2023-04-11 11:24:19 UTC Link ID Red Hat Product Errata RHBA-2023:1686
errata-xmlrpc 2023-04-11 13:11:37 UTC Link ID Red Hat Product Errata RHBA-2023:1688
errata-xmlrpc 2023-04-11 14:49:50 UTC Link ID Red Hat Product Errata RHBA-2023:1708
errata-xmlrpc 2023-04-11 21:35:14 UTC Link ID Red Hat Product Errata RHBA-2023:1736
errata-xmlrpc 2023-04-12 12:47:00 UTC Link ID Red Hat Product Errata RHBA-2023:1738
errata-xmlrpc 2023-04-12 21:25:14 UTC Link ID Red Hat Product Errata RHBA-2023:1764
errata-xmlrpc 2023-04-17 01:50:47 UTC Link ID Red Hat Product Errata RHBA-2023:1798
errata-xmlrpc 2023-04-17 13:18:32 UTC Link ID Red Hat Product Errata RHBA-2023:1800
errata-xmlrpc 2023-04-18 16:52:52 UTC Link ID Red Hat Product Errata RHBA-2023:1825
errata-xmlrpc 2023-04-18 21:30:17 UTC Link ID Red Hat Product Errata RHBA-2023:1850
errata-xmlrpc 2023-04-19 19:40:46 UTC Link ID Red Hat Product Errata RHBA-2023:1886
errata-xmlrpc 2023-04-24 01:45:01 UTC Link ID Red Hat Product Errata RHBA-2023:1929
errata-xmlrpc 2023-04-26 08:07:10 UTC Link ID Red Hat Product Errata RHSA-2023:2022
Klaas Demter 2023-04-26 14:59:52 UTC Flags needinfo?(klaas)
errata-xmlrpc 2023-04-26 18:29:08 UTC Link ID Red Hat Product Errata RHBA-2023:2033
errata-xmlrpc 2023-04-27 13:25:47 UTC Link ID Red Hat Product Errata RHBA-2023:2048
errata-xmlrpc 2023-05-02 18:14:58 UTC Link ID Red Hat Product Errata RHBA-2023:2086
errata-xmlrpc 2023-05-03 02:30:42 UTC Link ID Red Hat Product Errata RHBA-2023:2088
errata-xmlrpc 2023-05-03 22:06:01 UTC Link ID Red Hat Product Errata RHBA-2023:2105
errata-xmlrpc 2023-05-03 22:25:46 UTC Link ID Red Hat Product Errata RHBA-2023:2106
errata-xmlrpc 2023-05-09 07:13:18 UTC Link ID Red Hat Product Errata RHSA-2023:2165
errata-xmlrpc 2023-05-16 08:29:40 UTC Link ID Red Hat Product Errata RHSA-2023:2932
errata-xmlrpc 2023-06-05 11:47:09 UTC Link ID Red Hat Product Errata RHSA-2023:3355
errata-xmlrpc 2023-06-05 11:50:59 UTC Link ID Red Hat Product Errata RHSA-2023:3354
errata-xmlrpc 2023-06-05 13:56:10 UTC Link ID Red Hat Product Errata RHSA-2023:3420
errata-xmlrpc 2023-06-05 14:16:40 UTC Link ID Red Hat Product Errata RHSA-2023:3421
errata-xmlrpc 2023-07-18 07:44:52 UTC Link ID Red Hat Product Errata RHSA-2023:4124
errata-xmlrpc 2023-07-18 08:19:42 UTC Link ID Red Hat Product Errata RHSA-2023:4128
errata-xmlrpc 2023-07-20 15:31:51 UTC Link ID Red Hat Product Errata RHBA-2023:4239
errata-xmlrpc 2023-07-25 07:52:56 UTC Link ID Red Hat Product Errata RHSA-2023:4252

Back to bug 2164440