CyberSecBulletin
CVE-2023-0286NVD status: Modified

OpenSSL: Access of Resource Using Incompatible Type

Published Updated By the CyberSecBulletin desk

CVE-2023-0286 is a high-severity access of resource using incompatible type vulnerability in OpenSSL, with a CVSS 3.1 base score of 7.4 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 3.0.8, 1.1.1t, 1.0.2zg as the first without the flaw, so updating OpenSSL to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 68.4% chance of exploitation within 30 days, which is in the top 0.65% of all scored CVEs.

Patch now

Exploitation in the next 30 days is more likely than not, according to EPSS.

What to do

  1. Update OpenSSL to 3.0.8 or 1.1.1t or 1.0.2zg, whichever matches your release line, or a later version.
  2. Update BFCClient to V2.17 or a later version.
  3. Update SCALANCE W1750D (JP) to V8.10.0.9 or a later version.
  4. Read the advisory on git.openssl.org for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
OpenSSLOpenSSL3.0.0 up to, but not including, 3.0.8; 1.1.1 up to, but not including, 1.1.1t; 1.0.2 up to, but not including, 1.0.2zg3.0.8, 1.1.1t, 1.0.2zg
SiemensBFCClientbefore V2.17V2.17
SiemensRUGGEDCOM APE1808all versionsNot stated
SiemensSCALANCE W1750D (JP)before V8.10.0.9V8.10.0.9
SiemensSCALANCE W1750D (ROW)before V8.10.0.9V8.10.0.9
SiemensSCALANCE W1750D (USA)before V8.10.0.9V8.10.0.9
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1V1.1
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 up to, but not including, V3.1.5V3.1.5
StormshieldStormshield Management Centerbefore 3.3.33.3.3
StormshieldStormshield Network Security2.7.0 up to, but not including, 2.7.11; 2.8.0 up to, but not including, 3.7.34; 3.8.0 up to, but not including, 3.11.22; 4.0.0 up to, but not including, 4.3.16; 4.4.0 up to, but not including, 4.6.32.7.11, 3.7.34, 3.11.22, 4.3.16, 4.6.3

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.4HighNVD
CVSS 3.17.4HighCISA (ADP)

Official description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Access of Resource Using Incompatible Type

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

More Access of Resource Using Incompatible Type vulnerabilities (CWE-843)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in OpenSSL

All OpenSSL vulnerabilities

Recent Access of Resource Using Incompatible Type vulnerabilities

Spotted an error? Tell us.