CVE-2024-4603
published 2024-05-16CVE-2024-4603: Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
1.13%
62.8th percentile
Issue summary: Checking excessively long DSA keys or parameters may be very
slow.
Impact summary: Applications that use the functions EVP_PKEY_param_check()
or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may
experience long delays. Where the key or parameters that are being checked
have been obtained from an untrusted source this may lead to a Denial of
Service.
The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform
various checks on DSA parameters. Some of those computations take a long time
if the modulus (`p` parameter) is too large.
Trying to use a very large modulus is slow and OpenSSL will not allow using
public keys with a modulus which is over 10,000 bits in length for signature
verification. However the key and parameter check functions do not limit
the modulus size when performing the checks.
An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()
and supplies a key or parameters obtained from an untrusted source could be
vulnerable to a Denial of Service attack.
These functions are not called by OpenSSL itself on untrusted DSA keys so
only applications that directly call these functions may be vulnerable.
Also vulnerable are the OpenSSL pkey and pkeyparam command line applications
when using the `-check` option.
The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssl | < openssl 3.0.14-1~deb12u1 (bookworm) | openssl 3.0.14-1~deb12u1 (bookworm) |
| msrc | azl3_cloud-hypervisor-cvm_38.0.72-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_cloud-hypervisor-cvm_38.0.72.2-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_edk2_20240524git3e722403cd16-8_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.10.0-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_openssl_3.3.0-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_openssl_3.3.2-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_qemu_8.2.0-16_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_cloud-hypervisor-cvm_38.0.72-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_cloud-hypervisor-cvm_38.0.72.2-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_hvloader_1.0.1-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_hvloader_1.0.1-6_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_nodejs18_18.18.2-7_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| openssl | openssl | >= 0 < 3.0.13-r0 | 3.0.13-r0 |
| openssl | openssl | >= 0 < 3.1.5-r0 | 3.1.5-r0 |
| openssl | openssl | >= 0 < 3.1.5-r0 | 3.1.5-r0 |
| openssl | openssl | >= 0 < 3.3.0-r2 | 3.3.0-r2 |
| openssl | openssl | >= 0 < 3.3.0-r2 | 3.3.0-r2 |
| openssl | openssl | >= 0 < 3.3.0-r2 | 3.3.0-r2 |
| openssl | openssl | >= 0 < 3.3.0-r2 | 3.3.0-r2 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
osv5.9MEDIUM
vendor_ubuntu5.9MEDIUM
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
openssl vulnerabilities
osv·2024-07-31·CVSS 5.9
CVE-2024-2511 [MEDIUM] openssl vulnerabilities
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled TLSv1.3 sessions when
certain non-default TLS server configurations were in use. A remote
attacker could possibly use this issue to cause OpenSSL to consume
resources, leading to a denial of service. (CVE-2024-2511)
It was discovered that OpenSSL incorrectly handled checking excessively
long DSA keys or parameters. A remote attacker could possibly use this
issue to cause OpenSSL to consume resources, leading to a denial of
service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-4603)
William Ahern discovered that OpenSSL incorrectly handled certain memory
operations in a rarely-used API. A remote attacker could use this issue to
cause OpenSSL to crash, resulting in a denial of service,
OSV
CVE-2024-4603: Issue summary: Checking excessively long DSA keys or parameters may be very slow
osv·2024-05-16·CVSS 5.3
CVE-2024-4603 [MEDIUM] CVE-2024-4603: Issue summary: Checking excessively long DSA keys or parameters may be very slow
Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do
GHSA
GHSA-85xr-ghj6-6m46: Issue summary: Checking excessively long DSA keys or parameters may be very
slow
ghsa_unreviewed·2024-05-16
CVE-2024-4603 [MEDIUM] CWE-606 GHSA-85xr-ghj6-6m46: Issue summary: Checking excessively long DSA keys or parameters may be very
slow
Issue summary: Checking excessively long DSA keys or parameters may be very
slow.
Impact summary: Applications that use the functions EVP_PKEY_param_check()
or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may
experience long delays. Where the key or parameters that are being checked
have been obtained from an untrusted source this may lead to a Denial of
Service.
The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform
various checks on DSA parameters. Some of those computations take a long time
if the modulus (`p` parameter) is too large.
Trying to use a very large modulus is slow and OpenSSL will not allow using
public keys with a modulus which is over 10,000 bits in length for signature
verification. However the key and parameter check functions
OSV
CVE-2024-4603: Issue summary: Checking excessively long DSA keys or parameters may be very
slow
osv·2024-05-16·CVSS 5.3
CVE-2024-4603 [MEDIUM] CVE-2024-4603: Issue summary: Checking excessively long DSA keys or parameters may be very
slow
Issue summary: Checking excessively long DSA keys or parameters may be very
slow.
Impact summary: Applications that use the functions EVP_PKEY_param_check()
or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may
experience long delays. Where the key or parameters that are being checked
have been obtained from an untrusted source this may lead to a Denial of
Service.
The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform
various checks on DSA parameters. Some of those computations take a long time
if the modulus (`p` parameter) is too large.
Trying to use a very large modulus is slow and OpenSSL will not allow using
public keys with a modulus which is over 10,000 bits in length for signature
verification. However the key and parameter check functions
CISA ICS
Siemens SCALANCE W700
cisa_ics·2025-02-13
Siemens SCALANCE W700
ICS Advisory
##
Siemens SCALANCE W700
Release DateFebruary 13, 2025
Alert CodeICSA-25-044-09
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SCALANCE W700
- Vulnerabilities: Double Free, Improper Restriction of Communication Channel to Intended Endpoints, Improper Resource Sh
CISA ICS
Siemens SCALANCE M-800 Family
cisa_ics·2024-11-14
Siemens SCALANCE M-800 Family
ICS Advisory
##
Siemens SCALANCE M-800 Family
Release DateNovember 14, 2024
Alert CodeICSA-24-319-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.6
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SCALANCE M-800 Family
- Vulnerabilities: Out-of-bounds Read, Missing Encryption of Sensitive Data, Integer Overflow or Wraparou
Palo Alto
PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
vendor_paloalto·2024-11-07·CVSS 6.8
CVE-2014-0195 [MEDIUM] PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to Cortex XDR Agent. While Cortex XDR Agent may include the
CVEs: CVE-2014-0195, CVE-2014-0224, CVE-2014-3509, CVE-2014-3512, CVE-2014-3513, CVE-2014-3567, CVE-2015-0209, CVE-2015-0292, CVE-2015-1789, CVE-2015-1791, CVE-2015-1793, CVE-2015-3194, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798, CVE-2016-0799, CVE-2016-2105, CVE-2016-2106, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, CVE-2016-2177, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2019-1551, CVE-2019-1552, CVE-2019-1559, CVE-2019-1563, CVE-2020-196
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (OpenSSL) — CVE-2024-4603
vendor_oracle·2024-10-15·CVSS 5.3
CVE-2024-4603 [MEDIUM] Oracle Oracle Communications Risk Matrix: Configuration (OpenSSL) — CVE-2024-4603
Oracle Oracle Communications Risk Matrix: Configuration (OpenSSL) vulnerability
CVE: CVE-2024-4603
CVSS: 5.3
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2024-07-31·CVSS 5.9
CVE-2024-4741 [MEDIUM] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
It was discovered that OpenSSL incorrectly handled TLSv1.3 sessions when
certain non-default TLS server configurations were in use. A remote
attacker could possibly use this issue to cause OpenSSL to consume
resources, leading to a denial of service. (CVE-2024-2511)
It was discovered that OpenSSL incorrectly handled checking excessively
long DSA keys or parameters. A remote attacker could possibly use this
issue to cause OpenSSL to consume resources, leading to a denial of
service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-4603)
William Ahern discovered that OpenSSL incorrectly handled certain memory
operations in a rarely-used API. A remote attacker could use this iss
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Database Core (OpenSSL) — CVE-2024-4603
vendor_oracle·2024-07-15·CVSS 5.3
CVE-2024-4603 [MEDIUM] Oracle Oracle Database Server Risk Matrix: Oracle Database Core (OpenSSL) — CVE-2024-4603
Oracle Oracle Database Server Risk Matrix: Oracle Database Core (OpenSSL) vulnerability
CVE: CVE-2024-4603
CVSS: 5.3
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Red Hat
openssl: Excessive time spent checking DSA keys and parameters
vendor_redhat·2024-05-16·CVSS 5.3
CVE-2024-4603 [MEDIUM] openssl: Excessive time spent checking DSA keys and parameters
openssl: Excessive time spent checking DSA keys and parameters
Issue summary: Checking excessively long DSA keys or parameters may be very
slow.
Impact summary: Applications that use the functions EVP_PKEY_param_check()
or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may
experience long delays. Where the key or parameters that are being checked
have been obtained from an untrusted source this may lead to a Denial of
Service.
The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform
various checks on DSA parameters. Some of those computations take a long time
if the modulus (`p` parameter) is too large.
Trying to use a very large modulus is slow and OpenSSL will not allow using
public keys with a modulus which is over 10,000 bits in length for signature
Microsoft
Excessive time spent checking DSA keys and parameters
vendor_msrc·2024-05-14·CVSS 5.3
CVE-2024-4603 [MEDIUM] CWE-606 Excessive time spent checking DSA keys and parameters
Excessive time spent checking DSA keys and parameters
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
openssl: openssl
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://lea
Debian
CVE-2024-4603: openssl - Issue summary: Checking excessively long DSA keys or parameters may be very slow...
vendor_debian·2024·CVSS 5.3
CVE-2024-4603 [MEDIUM] CVE-2024-4603: openssl - Issue summary: Checking excessively long DSA keys or parameters may be very slow...
Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-4603 openssl: Excessive time spent checking DSA keys and parameters
bugzilla·2024-05-17·CVSS 5.3
CVE-2024-4603 [MEDIUM] CVE-2024-4603 openssl: Excessive time spent checking DSA keys and parameters
CVE-2024-4603 openssl: Excessive time spent checking DSA keys and parameters
Issue summary: Checking excessively long DSA keys or parameters may be very
slow.
Impact summary: Applications that use the functions EVP_PKEY_param_check()
or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may
experience long delays. Where the key or parameters that are being checked
have been obtained from an untrusted source this may lead to a Denial of
Service.
The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform
various checks on DSA parameters. Some of those computations take a long time
if the modulus (`p` parameter) is too large.
Trying to use a very large modulus is slow and OpenSSL will not allow using
public keys with a modulus which is over 10,000 bits in len
Bugzilla
CVE-2024-23652 moby/buildkit: possible host system access from mount stub cleaner
bugzilla·2024-02-01·CVSS 9.1
CVE-2024-23652 [CRITICAL] CVE-2024-23652 moby/buildkit: possible host system access from mount stub cleaner
CVE-2024-23652 moby/buildkit: possible host system access from mount stub cleaner
Docker Buildkit <=v0.12.4, as used by the Docker engine. Exploitation of this issue can result in arbitrary file and directory deletion in the underlying host OS when building an image using a malicious Dockerfile or upstream image (i.e, when using FROM)
https://snyk.io/blog/cve-2024-23652-buildkit-build-time-container-teardown-arbitrary-delete/
https://github.com/moby/buildkit/pull/4603
https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8
https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7ehttps://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0dhttps://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740https://www.openssl.org/news/secadv/20240516.txthttp://www.openwall.com/lists/oss-security/2024/05/16/2https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7ehttps://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0dhttps://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740https://security.netapp.com/advisory/ntap-20240621-0001/https://www.openssl.org/news/secadv/20240516.txt
2024-05-16
Published