Skip to content
OpenAdvisories
High RHSA-2023:3722 5 CVEs

Red Hat Security Advisory: openssl security and bug fix update

Published Sep 16, 2024 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-debuginfo 1:3.0.7-16.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-debugsource 1:3.0.7-16.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-devel 1:3.0.7-16.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-libs-debuginfo 1:3.0.7-16.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-perl 1:3.0.7-16.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl 1:3.0.7-16.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl-debuginfo 1:3.0.7-16.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl-debugsource 1:3.0.7-16.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl-libs 1:3.0.7-16.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl-libs-debuginfo 1:3.0.7-16.el9_2

Vulnerabilities 5

  • High 7.5
    CVE-2023-0464 Public exploit

    Excessive Resource Usage Verifying X.509 Policy Constraints

    A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2023-2650 EPSS 75%

    Possible DoS translating ASN.1 object identifiers

    Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2023-1255

    Input buffer over-read in AES-XTS implementation on 64 bit ARM

    Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform ca…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • Medium 5.3
    CVE-2023-0465

    Invalid certificate policies in leaf certificates are silently ignored

    Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate pol…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2023-0466

    Certificate policy check not enabled

    The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or in…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2175860
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2175864
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2175868
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2175873
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2178029
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2178030
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2178034
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2178039
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2178137
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2179379
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2181082
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2182561
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2182565
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2188046
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2188052
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2188461
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2207947
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3722.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-0464
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-0464
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-0464
  • article
    https://www.openssl.org/news/secadv/20230322.txt
  • report
    https://access.redhat.com/security/cve/CVE-2023-0465
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-0465
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-0465
  • article
    https://www.openssl.org/news/secadv/20230328.txt
  • report
    https://access.redhat.com/security/cve/CVE-2023-0466
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-0466
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-0466
  • report
    https://access.redhat.com/security/cve/CVE-2023-1255
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-1255
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-1255
  • article
    https://www.openssl.org/news/secadv/20230420.txt
  • report
    https://access.redhat.com/security/cve/CVE-2023-2650
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-2650
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-2650
  • article
    https://www.openssl.org/news/secadv/20230530.txt