Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-3817 EUVD-2023-44449GHSA-c945-cqj5-wfv6

Excessive time spent checking DH q parameter value

Published Jul 31, 2023 · Updated Oct 14, 2026 · Assigned by openssl

Description

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_check(), DH_check_ex()
or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long
delays. Where the key or parameters that are being checked have been obtained
from an untrusted source this may lead to a Denial of Service.

The function DH_check() performs various checks on DH parameters. After fixing
CVE-2023-3446 it was discovered that a large q parameter value can also trigger
an overly long computation during some of these checks. A correct q value,
if present, cannot be larger than the modulus p parameter, thus it is
unnecessary to perform these checks if q is larger than p.

An application that calls DH_check() and supplies a key or parameters obtained
from an untrusted source could be vulnerable to a Denial of Service attack.

The function DH_check() is itself called by a number of other OpenSSL functions.
An application calling any of those other functions may similarly be affected.
The other functions affected by this are DH_check_ex() and
EVP_PKEY_param_check().

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications
when using the "-check" option.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Affected products

VendorProductAffectedFixed
OpenSSL OpenSSL 3.1.0 – < 3.1.2, 3.0.0 – < 3.0.10, 1.1.1 – < 1.1.1v, 1.0.2 – < 1.0.2zi 3.1.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 openssl 3.0.10-1 —
Debian 13 openssl 3.0.10-1 —
Debian 12 openssl 3.0.10-1~deb12u1 —
Debian 10 openssl 1.1.1n-0+deb10u6 DLA-3530-1
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS edk2 2024.02-2ubuntu0.6 USN-7894-1
Ubuntu 22.04 LTS edk2 2022.02-3ubuntu0.22.04.4 USN-7894-1
Ubuntu 22.04 LTS openssl 3.0.2-0ubuntu1.12 USN-6450-1
Ubuntu 20.04 LTS openssl 1.1.1f-1ubuntu2.20 USN-6435-2
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro FIPS 20.04 LTS openssl No fix yet —
Ubuntu Pro FIPS 18.04 LTS openssl No fix yet —
Ubuntu Pro FIPS 16.04 LTS openssl No fix yet —
Ubuntu Pro FIPS-updates 22.04 LTS openssl 3.0.2-0ubuntu1.12+Fips1 —
Ubuntu Pro FIPS-updates 20.04 LTS openssl 1.1.1f-1ubuntu2.fips.20 —
Ubuntu Pro FIPS-updates 18.04 LTS openssl 1.1.1-1ubuntu2.fips.2.1~18.04.23.3 —
Ubuntu Pro FIPS-updates 16.04 LTS openssl 1.0.2g-1ubuntu4.fips.4.20.10 —
Ubuntu Pro FIPS-preview 22.04 LTS openssl 3.0.2-0ubuntu1.12+Fips1 —
Ubuntu Pro 22.04 LTS nodejs No fix yet —
Ubuntu Pro 20.04 LTS edk2 No fix yet —
Ubuntu Pro 18.04 LTS edk2 No fix yet —
Ubuntu Pro 18.04 LTS openssl 1.1.1-1ubuntu2.1~18.04.23+esm3 USN-6435-1
Ubuntu Pro 18.04 LTS openssl1.0 1.0.2n-1ubuntu5.13+esm1 USN-6709-1
Ubuntu Pro 16.04 LTS edk2 No fix yet —
Ubuntu Pro 16.04 LTS openssl 1.0.2g-1ubuntu4.20+esm10 USN-6435-1
ReleasePackageFixed inAdvisory
RHEL 9 openssl +3 1:3.0.7-27.el9 RHSA-2024:2447
RHEL 8 openssl +3 1:1.1.1k-12.el8_9 RHSA-2023:7877
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite Utils 6 foreman +1 3.5.1.23-1.el8sat RHSA-2023:5931
Red Hat Satellite Capsule 6 foreman +1 3.5.1.23-1.el8sat RHSA-2023:5931
Red Hat Satellite Capsule 6 puppet-agent 7.26.0-3.el8sat RHSA-2023:5931
Red Hat Satellite Capsule 6 python-django +1 3.2.21-1.el8pc RHSA-2023:5931
Red Hat Satellite Capsule 6 python-gitpython +1 3.1.32-1.el8pc RHSA-2023:5931
Red Hat Satellite 6 foreman +12 3.5.1.23-1.el8sat RHSA-2023:5931
Red Hat Satellite 6 puppet-agent 7.26.0-3.el8sat RHSA-2023:5931
Red Hat Satellite 6 python-django +1 3.2.21-1.el8pc RHSA-2023:5931
Red Hat Satellite 6 python-gitpython +1 3.1.32-1.el8pc RHSA-2023:5931
Red Hat Satellite 6 rubygem-git 1.18.0-1.el8sat RHSA-2023:5931
Red Hat Satellite 6 yggdrasil-worker-forwarder 0.0.3-1.el8sat RHSA-2023:5931
RHEL 8.8 EUS openssl +3 1:1.1.1k-12.el8_8 RHSA-2024:0154
RHEL 8.6 EUS openssl +3 1:1.1.1k-12.el8_6 RHSA-2024:0208
Red Hat JBoss Web Server 5 jws5-tomcat +11 9.0.62-19.redhat_00017.1.el7jws RHSA-2023:7622
Red Hat JBoss Web Server 5 jws5-tomcat-native 1.2.31-16.redhat_16.el7jws RHSA-2023:7622
Red Hat JBoss Core Services 1 jbcs-httpd24-curl +2 8.4.0-2.el7jbcs RHSA-2023:7625
Red Hat JBoss Core Services 1 jbcs-httpd24-mod_http2 1.15.19-32.el7jbcs RHSA-2023:7625
Red Hat JBoss Core Services 1 jbcs-httpd24-mod_jk +1 1.2.49-1.redhat_1.el7jbcs RHSA-2023:7625
Red Hat JBoss Core Services 1 jbcs-httpd24-openssl +4 1:1.1.1k-16.el7jbcs RHSA-2023:7625

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 openssl +3 1:3.0.7-27.el9 ALSA-2024:2447
AlmaLinux 8 openssl +3 1:1.1.1k-12.el8_9 ALSA-2023:7877

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 openssl 1:1.1.1k-12.el8_9 RLSA-2023:7877
ReleasePackageFixed inAdvisory
SLES 15 SP5 openssl-1_0_0 1.0.2p-150000.3.85.1 SUSE-SU-2023:3338-1
SLES 15 SP5 openssl-1_1 1.1.1l-150500.17.15.1 SUSE-SU-2023:3242-1
SLES 15 SP5 openssl-3 3.0.8-150500.5.11.1 SUSE-SU-2023:4190-1, SUSE-SU-2023:3243-1
SLES 15 SP4 openssl-1_0_0 1.0.2p-150000.3.85.1 SUSE-SU-2023:3338-1
SLES 15 SP4 openssl-1_1 1.1.1l-150400.7.53.1 SUSE-SU-2023:3397-1
SLES 15 SP4 openssl-3 3.0.8-150400.4.34.1 SUSE-SU-2023:4189-1, SUSE-SU-2023:3244-1
SLES 15 SP3 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-2
SLES 15 SP2 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-2
SLES 15 SP1 openssl-1_1 1.1.0i-150100.14.65.6 SUSE-SU-2023:3958-1
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 openssl-1_0_0 1.0.2p-3.84.1 SUSE-SU-2023:3339-1
SLES 12 SP5 openssl-1_1 1.1.1d-2.98.1 SUSE-SU-2023:3239-1
SLES 12 SP2 openssl 1.0.2j-60.104.1 SUSE-SU-2023:3308-1
SLES for SAP 15 SP3 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-2
SLES for SAP 15 SP2 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-2
SLES for SAP 15 SP1 openssl-1_1 1.1.0i-150100.14.65.6 SUSE-SU-2023:3958-1
SLES for SAP 12 SP5 openssl-1_0_0 1.0.2p-3.84.1 SUSE-SU-2023:3339-1
SLES for SAP 12 SP5 openssl-1_1 1.1.1d-2.98.1 SUSE-SU-2023:3239-1
SLE Micro 5.4 openssl-1_1 1.1.1l-150400.7.53.1 SUSE-SU-2023:3397-1
SLE Micro 5.4 openssl-3 3.0.8-150400.4.34.1 SUSE-SU-2023:4189-1, SUSE-SU-2023:3244-2
SLE Micro 5.3 openssl-1_1 1.1.1l-150400.7.53.1 SUSE-SU-2023:3397-1
SLE Micro 5.3 openssl-3 3.0.8-150400.4.34.1 SUSE-SU-2023:4189-1, SUSE-SU-2023:3244-2
SLE Micro 5.2 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-1
SLE Micro 5.1 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-1
SLE HPC 15 SP3 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-2
SLE HPC 15 SP2 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-2
SLE HPC 15 SP1 openssl-1_1 1.1.0i-150100.14.65.6 SUSE-SU-2023:3958-1
SUSE Manager Server 4.2 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-1
SUSE Manager Proxy 4.2 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-1
SUSE Enterprise Storage 7.1 openssl-1_1 1.1.1d-150200.11.75.1 SUSE-SU-2023:3291-2
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed openssl-1_0_0 1.0.2u-22.1 openSUSE-SU-2024:13111-1
openSUSE Tumbleweed openssl-1_1 1.1.1v-1.1 openSUSE-SU-2024:13090-1
openSUSE Tumbleweed openssl-3 3.1.2-1.1 openSUSE-SU-2024:13097-1
openSUSE Leap 15.5 openssl-1_0_0 1.0.2p-150000.3.85.1 SUSE-SU-2023:3338-1
openSUSE Leap 15.5 openssl-1_1 1.1.1l-150500.17.15.1 SUSE-SU-2023:3242-1
openSUSE Leap 15.5 openssl-3 3.0.8-150500.5.11.1 SUSE-SU-2023:4190-1, SUSE-SU-2023:3243-1
openSUSE Leap 15.4 openssl-1_0_0 1.0.2p-150000.3.85.1 SUSE-SU-2023:3338-1
openSUSE Leap 15.4 openssl-1_1 1.1.1l-150400.7.53.1 SUSE-SU-2023:3397-1
openSUSE Leap 15.4 openssl-3 3.0.8-150400.4.34.1 SUSE-SU-2023:4189-1, SUSE-SU-2023:3244-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.4 openssl-1_1 1.1.1l-150400.7.53.1 SUSE-SU-2023:3397-1
openSUSE Leap Micro 5.4 openssl-3 3.0.8-150400.4.34.1 SUSE-SU-2023:4189-1, SUSE-SU-2023:3244-2
openSUSE Leap Micro 5.3 openssl-1_1 1.1.1l-150400.7.53.1 SUSE-SU-2023:3397-1
openSUSE Leap Micro 5.3 openssl-3 3.0.8-150400.4.34.1 SUSE-SU-2023:4189-1, SUSE-SU-2023:3244-2
ReleasePackageFixed inAdvisory
Alpine v3.24 openssl 3.1.2-r0 —
Alpine v3.23 openssl 3.1.2-r0 —
Alpine v3.22 openssl 3.1.2-r0 —
Alpine v3.21 openssl 3.1.2-r0 —
Alpine v3.20 openssl 3.1.2-r0 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 openssl 3.1.2-r0 —
Alpine v3.18 openssl 3.1.2-r0 —
Alpine v3.17 openssl 3.0.10-r0 —
Alpine v3.16 openssl 1.1.1v-r0 —
Alpine v3.16 openssl3 3.0.11-r0 —
Alpine v3.15 openssl 1.1.1v-r0 —
Alpine v3.15 openssl3 3.0.11-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 openssl +3 1:3.0.8-1.amzn2023.0.4 ALAS2023-2023-306
Amazon Linux 2 edk2-ovmf +4 20200801stable-1.amzn2.0.2 ALAS2-2023-2205
Amazon Linux 2 openssl +4 1:1.0.2k-24.amzn2.0.9 ALAS2-2023-2246
Amazon Linux 2 openssl11 +3 1:1.1.1g-12.amzn2.0.16 ALAS2-2023-2226

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 edk2 20230301gitf80f052277c8-37 —
Azure Linux 3 rust 1.68.2-5 —
Azure Linux 2 (CBL-Mariner) edk2 20230301gitf80f052277c8-37 —
Azure Linux 2 (CBL-Mariner) hvloader 1.0.1-9 —
Azure Linux 2 (CBL-Mariner) openssl 1.1.1k-26 —
Azure Linux 2 (CBL-Mariner) rust 1.68.2-5 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 openssl +3 1:3.0.7-27.0.3.el9 ELSA-2024-2447
Oracle Linux 9 openssl-fips-provider 3.0.7-2.0.1.el9 ELSA-2024-2447
Oracle Linux 8 openssl +3 1:1.1.1k-12.el8_9 ELSA-2023-7877

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling openssl 3.1.1-r4 —

Advisories 50

References