Intel

CVE-2023-6237

Siemens ProductCERT Advisory SSA-265688

mediumEPSS 2.3%

Description

Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service. When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time. An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function EVP_PKEY_public_check() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the '-pubin' and '-check' options on untrusted data. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

Source: SIEMENS_ADVISORYSIEMENS_ADVISORYBSI_CSAFBSIBSI_CSAFBSISIEMENS_ADVISORYCVELISTV5EUVDSIEMENS_ADVISORY

Metrics

Severity
medium
Priority score
209.72
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
5.9
Source: nvd-v3
CVSS v3
5.9
CVSS v4
—
EPSS percentile
82.3 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
2.3 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2022-02-18 00:00 UTC
CWE
CWE-606

Weakness classes (CWE)

  • CWE-606Base

    Unchecked Input for Loop Condition

    The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

    cwe.mitre.org →

Affected operating systems

  • linux

    amazon / amazon_linux

  • linux

    suse / basesystem_module15

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    debian / debian_linux13.0

  • linux

    suse / development_tools_module15

  • linux

    redhat / enterprise_linux10.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • linux

    redhat / enterprise_linux_aus8.4

  • linux

    redhat / enterprise_linux_aus8.6

  • linux

    redhat / enterprise_linux_eus10.0

  • linux

    redhat / enterprise_linux_eus8.4

  • linux

    redhat / enterprise_linux_eus9.4

  • linux

    redhat / enterprise_linux_eus9.6

  • linux

    redhat / enterprise_linux_tus8.6

  • linux

    redhat / enterprise_linux_tus8.8

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions8.6

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions8.8

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions9.0

  • linux

    redhat / enterprise_linux_update_services_for_sap_solutions9.2

  • linux

    opensuse / leap15.3

  • linux

    opensuse / leap15.4

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • android

    :linux_kernel::0

  • android

    :linux_kernel:Kernel

  • arista

    cloudvision_agni2024.4.0 – 2025.2.2

  • arista

    cloudvision_portal2024.2.0 – 2026.1.0

  • arista

    velocloud_edge4.5.0 – 6.4.1

  • arista

    velocloud_gateway

  • arista

    velocloud_orchestrator

  • bitnami

    java-min1.9.0

  • Dell

    ECS3.8.1.0

  • Dell

    NetWorkerVirtual Edition

  • Dell

    NetWorkervProxy

  • Dell

    PowerProtect Data Domain7.10.1.70

  • Dell

    PowerProtect Data Domain7.13.1.40

  • Dell

    PowerProtect Data Domain8.3.1.10

  • Dell

    PowerProtect Data Domain8.4.0.0

  • Dell

    PowerProtect Data Domain< 7.10.1.70

    fixed in 7.10.1.70

  • Dell

    PowerProtect Data Domain< 7.13.1.40

    fixed in 7.13.1.40

  • Dell

    PowerProtect Data Domain< 8.3.1.10

    fixed in 8.3.1.10

  • Dell

    PowerProtect Data Domain< 8.4.0.0

    fixed in 8.4.0.0

  • Dell

    PowerScale OneFSNode Firmware Package 14.1

  • Dell

    Secure Connect GatewayAppliance 5.32.00.18

  • Hitachi Energy

    RTU500< 13.9.1

    fixed in 13.9.1

  • HPE

    HP-UXOpenSSL Software <A.03.00.15.001

  • IBM

    AIX7.2

References & sources

Linked CVEs

Show 423 more CVEs
IDCVE-2023-6237
Siemens ProductCERT Advisory SSA-265688 — CVE-2023-6237 | NEOSEC Intel