Skip to content
OpenAdvisories
Medium USN-6188-1 1 CVE

openssl vulnerability

Published Jun 22, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Matt Caswell discovered that OpenSSL incorrectly handled certain ASN.1
object identifiers. A remote attacker could possibly use this issue to
cause OpenSSL to consume resources, resulting in a denial of service.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS openssl 1.0.1f-1ubuntu2.27+esm9
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS openssl 1.0.2g-1ubuntu4.20+esm9

Vulnerabilities 1

  • Medium 6.5
    CVE-2023-2650 EPSS 75%

    Possible DoS translating ASN.1 object identifiers

    Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2023-2650