diff options
| author | Bernard Spil <brnrd@FreeBSD.org> | 2023-03-24 11:42:38 +0000 |
|---|---|---|
| committer | Bernard Spil <brnrd@FreeBSD.org> | 2023-03-24 11:42:38 +0000 |
| commit | 7bb1a7b54624d5a17b6e6a6d7d445df904589675 (patch) | |
| tree | 2ad468fec01808d6fe3b4f4b10d918d4eb6ac838 | |
| parent | 2e30b7de00f398f5e636bb3ca3586fe3172bcad5 (diff) | |
| download | ports-7bb1a7b54624d5a17b6e6a6d7d445df904589675.tar.gz ports-7bb1a7b54624d5a17b6e6a6d7d445df904589675.zip | |
security/vuxml: Document OpenSSL DoS vulnerability
| -rw-r--r-- | security/vuxml/vuln/2023.xml | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 7ffcc9c7abe8..d0b89ac86a40 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,47 @@ + <vuln vid="1ba034fb-ca38-11ed-b242-d4c9ef517024"> + <topic>OpenSSL -- Excessive Resource Usage Verifying X.509 Policy Constraints</topic> + <affects> + <package> + <name>openssl</name> + <range><lt>1.1.1t,1_1</lt></range> + </package> + <package> + <name>openssl30</name> + <range><lt>3.0.8_1</lt></range> + </package> + <package> + <name>openssl31</name> + <range><lt>3.1.0_1</lt></range> + </package> + <package> + <name>openssl-quic</name> + <range><lt>3.1.0</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The OpenSSL project reports:</p> + <blockquote cite="https://www.openssl.org/news/secadv/20230322.txt"> + <p>Severity: Low</p> + <p>A security vulnerability has been identified in all supported versions + of OpenSSL related to the verification of X.509 certificate chains + that include policy constraints. Attackers may be able to exploit this + vulnerability by creating a malicious certificate chain that triggers + exponential use of computational resources, leading to a denial-of-service + (DoS) attack on affected systems.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2023-0464</cvename> + <url>https://www.openssl.org/news/secadv/20230322.txt</url> + </references> + <dates> + <discovery>2023-03-23</discovery> + <entry>2023-03-24</entry> + </dates> + </vuln> + <vuln vid="2fdb053c-ca25-11ed-9d7e-080027f5fec9"> <topic>rack -- possible denial of service vulnerability in header parsing</topic> <affects> |