Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Resumen del problema: Durante el procesamiento de un mensaje CMS EnvelopedData manipulado con KeyTransportRecipientInfo, puede ocurrir una desreferencia de puntero NULL. Resumen del impacto: Las aplicaciones que procesan datos CMS controlados por el atacante pueden fallar antes de que ocurran operaciones de autenticación o criptográficas, lo que resulta en denegación de servicio. Cuando se procesa un mensaje CMS EnvelopedData que utiliza KeyTransportRecipientInfo con cifrado RSA-OAEP, el campo de parámetros opcionales del identificador de algoritmo RSA-OAEP SourceFunc se examina sin verificar su presencia. Esto resulta en una desreferencia de puntero NULL si el campo falta. Las aplicaciones y servicios que llaman a CMS_decrypt() con entrada no confiable (por ejemplo, procesamiento S/MIME o protocolos basados en CMS) son vulnerables. Los módulos FIPS en 3.6, 3.5, 3.4, 3.3 y 3.0 no se ven afectados por este problema, ya que el código afectado está fuera del límite del módulo FIPS de OpenSSL.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| openssl | openssl | * | <built-in method update of dict object at 0x7fd36b3b8040> | Application |
| openssl | openssl | * | <built-in method update of dict object at 0x7fd38545db40> | Application |
| openssl | openssl | * | <built-in method update of dict object at 0x7fd385615740> | Application |
| openssl | openssl | * | <built-in method update of dict object at 0x7fd39c488980> | Application |
| openssl | openssl | * | <built-in method update of dict object at 0x7fd385617f80> | Application |
| openssl | openssl | * | <built-in method update of dict object at 0x7fd385616b40> | Application |
| openssl | openssl | * | <built-in method update of dict object at 0x7fd340176d00> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |