Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | LOW |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-606
|
| [email protected] | Primary |
en
CWE-834
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| openssl | openssl | * | <built-in method update of dict object at 0x7fd36a685a80> | Application |
| openssl | openssl | * | <built-in method update of dict object at 0x7fd369b56740> | Application |
| openssl | openssl | 1.0.2 | <built-in method update of dict object at 0x7fd384aa8b00> | Application |
| openssl | openssl | 1.0.2 | <built-in method update of dict object at 0x7fd369b55bc0> | Application |
| openssl | openssl | 1.0.2 | <built-in method update of dict object at 0x7fd3688a54c0> | Application |
| openssl | openssl | 1.0.2 | <built-in method update of dict object at 0x7fd384238140> | Application |
| openssl | openssl | 1.0.2a | <built-in method update of dict object at 0x7fd3426e9400> | Application |
| openssl | openssl | 1.0.2b | <built-in method update of dict object at 0x7fd384e97400> | Application |
| openssl | openssl | 1.0.2c | <built-in method update of dict object at 0x7fd36b8debc0> | Application |
| openssl | openssl | 1.0.2d | <built-in method update of dict object at 0x7fd39f9e9600> | Application |
| openssl | openssl | 1.0.2e | <built-in method update of dict object at 0x7fd369b57e80> | Application |
| openssl | openssl | 1.0.2f | <built-in method update of dict object at 0x7fd3426eb440> | Application |
| openssl | openssl | 1.0.2g | <built-in method update of dict object at 0x7fd384aa8140> | Application |
| openssl | openssl | 1.0.2h | <built-in method update of dict object at 0x7fd36b728a40> | Application |
| openssl | openssl | 1.0.2i | <built-in method update of dict object at 0x7fd36a717940> | Application |
| openssl | openssl | 1.0.2j | <built-in method update of dict object at 0x7fd36a717e40> | Application |
| openssl | openssl | 1.0.2k | <built-in method update of dict object at 0x7fd36adbca40> | Application |
| openssl | openssl | 1.0.2l | <built-in method update of dict object at 0x7fd3702277c0> | Application |
| openssl | openssl | 1.0.2m | <built-in method update of dict object at 0x7fd370226100> | Application |
| openssl | openssl | 1.0.2n | <built-in method update of dict object at 0x7fd36a717700> | Application |
| openssl | openssl | 1.0.2o | <built-in method update of dict object at 0x7fd370225d40> | Application |
| openssl | openssl | 1.0.2p | <built-in method update of dict object at 0x7fd370226500> | Application |
| openssl | openssl | 1.0.2q | <built-in method update of dict object at 0x7fd3702251c0> | Application |
| openssl | openssl | 1.0.2r | <built-in method update of dict object at 0x7fd370227640> | Application |
| openssl | openssl | 1.0.2s | <built-in method update of dict object at 0x7fd370225a40> | Application |
| openssl | openssl | 1.0.2t | <built-in method update of dict object at 0x7fd2d83cd880> | Application |
| openssl | openssl | 1.0.2u | <built-in method update of dict object at 0x7fd39c4c8780> | Application |
| openssl | openssl | 1.0.2v | <built-in method update of dict object at 0x7fd368636d00> | Application |
| openssl | openssl | 1.0.2w | <built-in method update of dict object at 0x7fd370347740> | Application |
| openssl | openssl | 1.0.2x | <built-in method update of dict object at 0x7fd319e7a500> | Application |
| openssl | openssl | 1.0.2y | <built-in method update of dict object at 0x7fd3094e5200> | Application |
| openssl | openssl | 1.0.2za | <built-in method update of dict object at 0x7fd36b8a5580> | Application |
| openssl | openssl | 1.0.2zb | <built-in method update of dict object at 0x7fd3426e9b00> | Application |
| openssl | openssl | 1.0.2zc | <built-in method update of dict object at 0x7fd38674fc40> | Application |
| openssl | openssl | 1.0.2zd | <built-in method update of dict object at 0x7fd36b8a7a80> | Application |
| openssl | openssl | 1.0.2ze | <built-in method update of dict object at 0x7fd340bfdf40> | Application |
| openssl | openssl | 1.0.2zf | <built-in method update of dict object at 0x7fd38674c840> | Application |
| openssl | openssl | 1.0.2zg | <built-in method update of dict object at 0x7fd36a6d7200> | Application |
| openssl | openssl | 1.0.2zh | <built-in method update of dict object at 0x7fd289ceec80> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd36a6d0580> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd36a6d3440> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd369b54640> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd385620c00> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd3694caa00> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd369b54880> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd38674c100> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd341757780> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd38674d1c0> | Application |
| openssl | openssl | 1.1.1 | <built-in method update of dict object at 0x7fd38674dbc0> | Application |
| openssl | openssl | 1.1.1a | <built-in method update of dict object at 0x7fd3694cbac0> | Application |
| openssl | openssl | 1.1.1b | <built-in method update of dict object at 0x7fd36b72b900> | Application |
| openssl | openssl | 1.1.1c | <built-in method update of dict object at 0x7fd38674e8c0> | Application |
| openssl | openssl | 1.1.1d | <built-in method update of dict object at 0x7fd340bfcdc0> | Application |
| openssl | openssl | 1.1.1e | <built-in method update of dict object at 0x7fd36b72abc0> | Application |
| openssl | openssl | 1.1.1f | <built-in method update of dict object at 0x7fd340bff340> | Application |
| openssl | openssl | 1.1.1g | <built-in method update of dict object at 0x7fd370227180> | Application |
| openssl | openssl | 1.1.1h | <built-in method update of dict object at 0x7fd36a6d04c0> | Application |
| openssl | openssl | 1.1.1i | <built-in method update of dict object at 0x7fd36b72a600> | Application |
| openssl | openssl | 1.1.1j | <built-in method update of dict object at 0x7fd340bfdb80> | Application |
| openssl | openssl | 1.1.1k | <built-in method update of dict object at 0x7fd38668b640> | Application |
| openssl | openssl | 1.1.1l | <built-in method update of dict object at 0x7fd340bfedc0> | Application |
| openssl | openssl | 1.1.1m | <built-in method update of dict object at 0x7fd340bfda80> | Application |
| openssl | openssl | 1.1.1n | <built-in method update of dict object at 0x7fd39c4d7fc0> | Application |
| openssl | openssl | 1.1.1o | <built-in method update of dict object at 0x7fd340bfd280> | Application |
| openssl | openssl | 1.1.1p | <built-in method update of dict object at 0x7fd36971c140> | Application |
| openssl | openssl | 1.1.1q | <built-in method update of dict object at 0x7fd340bffd00> | Application |
| openssl | openssl | 1.1.1r | <built-in method update of dict object at 0x7fd340bfeec0> | Application |
| openssl | openssl | 1.1.1s | <built-in method update of dict object at 0x7fd340bfe200> | Application |
| openssl | openssl | 1.1.1t | <built-in method update of dict object at 0x7fd340bfe840> | Application |
| openssl | openssl | 1.1.1u | <built-in method update of dict object at 0x7fd340bfd540> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2n:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2o:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2p:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2q:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2r:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2s:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2t:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2u:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2v:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2w:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2x:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2y:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2za:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2zb:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2zc:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2zd:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2ze:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2zf:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2zg:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2zh:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:pre1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:pre2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:pre3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:pre4:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:pre5:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:pre6:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:pre7:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:pre8:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1:pre9:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1a:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1b:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1c:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1d:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1e:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1f:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1g:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1h:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1i:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1j:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1l:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1m:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1n:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1o:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1p:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1r:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1s:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1t:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.1.1u:*:*:*:*:*:*:* |