CVE-2023-6237 — Unchecked Input for Loop Condition in Openssl
Severity
5.9MEDIUMNVD
OSV7.4OSV5.3
EPSS
0.5%
top 33.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 25
Latest updateNov 28
Description
Issue summary: Checking excessively long invalid RSA public keys may take
a long time.
Impact summary: Applications that use the function EVP_PKEY_public_check()
to check RSA public keys may experience long delays. Where the key that
is being checked has been obtained from an untrusted source this may lead
to a Denial of Service.
When function EVP_PKEY_public_check() is called on RSA public keys,
a computation is done to confirm that the RSA modulus, n, is composite.
For valid RSA keys, n is a…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6
Affected Packages24 packages
🔴Vulnerability Details
8OSV▶
CVE-2023-6237: Issue summary: Checking excessively long invalid RSA public keys may take a long time↗2024-04-25
GHSA▶
GHSA-hvc4-mjv4-5mw6: Issue summary: Checking excessively long invalid RSA public keys may take
a long time↗2024-04-25
OSV▶
CVE-2023-6237: Issue summary: Checking excessively long invalid RSA public keys may take
a long time↗2024-04-25