CVE-2023-6237

一、漏洞信息
 漏洞编号：[CVE-2023-6237](https://nvd.nist.gov/vuln/detail/CVE-2023-6237)
 漏洞归属组件：[compat-openssl11](https://gitee.com/src-openeuler/compat-openssl11)
 漏洞归属的版本：1.1.1m
 CVSS V3.0分值：
  BaseScore：5.9 Medium
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  Issue summary: Checking excessively long invalid RSA public keys may takea long time.Impact summary: Applications that use the function EVP_PKEY_public_check()to check RSA public keys may experience long delays. Where the key thatis being checked has been obtained from an untrusted source this may leadto a Denial of Service.When function EVP_PKEY_public_check() is called on RSA public keys,a computation is done to confirm that the RSA modulus, n, is composite.For valid RSA keys, n is a product of two or more large primes and thiscomputation completes quickly. However, if n is an overly large prime,then this computation would take a long time.An application that calls EVP_PKEY_public_check() and supplies an RSA keyobtained from an untrusted source could be vulnerable to a Denial of Serviceattack.The function EVP_PKEY_public_check() is not called from other OpenSSLfunctions however it is called from the OpenSSL pkey command lineapplication. For that reason that application is also vulnerable if usedwith the  -pubin  and  -check  options on untrusted data.The OpenSSL SSL/TLS implementation is not affected by this issue.The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.
 漏洞公开时间：2024-04-25 15:15:45
 漏洞创建时间：2025-02-05 21:40:32
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-6237
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| openssl-security.openssl.org | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d |  |
| openssl-security.openssl.org | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a |  |
| openssl-security.openssl.org | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 |  |
| openssl-security.openssl.org | https://www.openssl.org/news/secadv/20240115.txt |  |
| redhat_bugzilla | https://www.openssl.org/news/secadv/20240115.txt | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 |
| redhat_bugzilla | https://www.openwall.com/lists/oss-security/2024/01/15/2 | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 |
| redhat_bugzilla | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 |
| redhat_bugzilla | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 |
| redhat_bugzilla | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2447 | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:9088 | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6237 | https://ubuntu.com/security/CVE-2023-6237 |
| ubuntu | https://www.openssl.org/news/secadv/20240115.txt | https://ubuntu.com/security/CVE-2023-6237 |
| ubuntu | https://ubuntu.com/security/notices/USN-6622-1 | https://ubuntu.com/security/CVE-2023-6237 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-6237 | https://ubuntu.com/security/CVE-2023-6237 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-6237 | https://ubuntu.com/security/CVE-2023-6237 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-6237 | https://ubuntu.com/security/CVE-2023-6237 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-6237 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-6237 |
| cve_search |  | https://www.openssl.org/news/secadv/20240115.txt |
| cve_search |  | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a |
| cve_search |  | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 |
| cve_search |  | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0020.html |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-6237 | https://explore.alas.aws.amazon.com/CVE-2023-6237.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6237 | https://explore.alas.aws.amazon.com/CVE-2023-6237.html |
| snyk | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d | https://security.snyk.io/vuln/SNYK-PYTHON-PYOPENSSL-6157250 |
| snyk | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a | https://security.snyk.io/vuln/SNYK-PYTHON-PYOPENSSL-6157250 |
| snyk | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 | https://security.snyk.io/vuln/SNYK-PYTHON-PYOPENSSL-6157250 |
| snyk | https://github.com/pyca/cryptography/commit/4b5be7b0032ade70e09a43f9d857708e36170bbc | https://security.snyk.io/vuln/SNYK-PYTHON-PYOPENSSL-6157250 |
| snyk | https://www.openssl.org/news/secadv/20240115.txt | https://security.snyk.io/vuln/SNYK-PYTHON-PYOPENSSL-6157250 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 | https://security.snyk.io/vuln/SNYK-PYTHON-PYOPENSSL-6157250 |
| snyk | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d | https://security.snyk.io/vuln/SNYK-RUBY-OPENSSL-6157246 |
| snyk | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a | https://security.snyk.io/vuln/SNYK-RUBY-OPENSSL-6157246 |
| snyk | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 | https://security.snyk.io/vuln/SNYK-RUBY-OPENSSL-6157246 |
| snyk | https://github.com/pyca/cryptography/commit/4b5be7b0032ade70e09a43f9d857708e36170bbc | https://security.snyk.io/vuln/SNYK-RUBY-OPENSSL-6157246 |
| snyk | https://www.openssl.org/news/secadv/20240115.txt | https://security.snyk.io/vuln/SNYK-RUBY-OPENSSL-6157246 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 | https://security.snyk.io/vuln/SNYK-RUBY-OPENSSL-6157246 |
| snyk | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d | https://security.snyk.io/vuln/SNYK-RUST-OPENSSLSRC-6157249 |
| snyk | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a | https://security.snyk.io/vuln/SNYK-RUST-OPENSSLSRC-6157249 |
| snyk | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 | https://security.snyk.io/vuln/SNYK-RUST-OPENSSLSRC-6157249 |
| snyk | https://github.com/pyca/cryptography/commit/4b5be7b0032ade70e09a43f9d857708e36170bbc | https://security.snyk.io/vuln/SNYK-RUST-OPENSSLSRC-6157249 |
| snyk | https://www.openssl.org/news/secadv/20240115.txt | https://security.snyk.io/vuln/SNYK-RUST-OPENSSLSRC-6157249 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 | https://security.snyk.io/vuln/SNYK-RUST-OPENSSLSRC-6157249 |
| snyk | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d | https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6157248 |
| snyk | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a | https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6157248 |
| snyk | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 | https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6157248 |
| snyk | https://github.com/pyca/cryptography/commit/4b5be7b0032ade70e09a43f9d857708e36170bbc | https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6157248 |
| snyk | https://www.openssl.org/news/secadv/20240115.txt | https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6157248 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 | https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6157248 |
| snyk | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-6157247 |
| snyk | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-6157247 |
| snyk | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-6157247 |
| snyk | https://github.com/pyca/cryptography/commit/4b5be7b0032ade70e09a43f9d857708e36170bbc | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-6157247 |
| snyk | https://www.openssl.org/news/secadv/20240115.txt | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-6157247 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2258502 | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-6157247 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d |  | openssl-security.openssl.org |
|  |  | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a |  | openssl-security.openssl.org |
|  |  | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 |  | openssl-security.openssl.org |
|  |  | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a |  | redhat_bugzilla |
|  |  | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 |  | redhat_bugzilla |
|  |  | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d |  | redhat_bugzilla |
|  |  | https://github.com/openssl/openssl/commit/0b0f7abfb37350794a4b8960fafc292cd5d1b84d |  | snyk |
|  |  | https://github.com/openssl/openssl/commit/18c02492138d1eb8b6548cb26e7b625fb2414a2a |  | snyk |
|  |  | https://github.com/openssl/openssl/commit/a830f551557d3d66a84bbb18a5b889c640c36294 |  | snyk |
|  |  | https://github.com/pyca/cryptography/commit/4b5be7b0032ade70e09a43f9d857708e36170bbc |  | snyk |
| openssl |  | https://git.openssl.org/?p=openssl.git;a=commit;h=18c02492138d1eb8b6548cb26e7b625fb2414a2a |  | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  在OpenSSL中发现了一个缺陷。当在RSA公共键中调用EVP_PKEY_PUBLIC_CHECK（）函数时，进行了计算以确认RSA模量N是复合的。对于有效的RSA键，N是两个或多个大型素数的产物，此计算很快完成。但是，如果n是一个很大的素数，则此计算需要很长时间。调用evp_pkey_public_check（）并提供从不受信任源获得的RSA密钥的应用程序可能容易受到拒绝服务攻击的影响。该漏洞只影响openssl3.0的版本
 openEuler评分：
  5.9
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(1.1.1m):不受影响
2.openEuler-20.03-LTS-SP4:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.openEuler-24.03-LTS(1.1.1m):不受影响
6.openEuler-24.03-LTS-Next(1.1.1m):不受影响
7.openEuler-24.03-LTS-SP1(1.1.1m):不受影响

修复是否涉及abi变化(是/否)：
  1.master(1.1.1m):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3:否
4.openEuler-22.03-LTS-SP4:否
5.openEuler-24.03-LTS(1.1.1m):否
6.openEuler-24.03-LTS-Next(1.1.1m):否
7.openEuler-24.03-LTS-SP1(1.1.1m):否

原因说明：
  1.master(1.1.1m):不受影响-漏洞代码不存在
2.openEuler-20.03-LTS-SP4:不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP3:不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP4:不受影响-漏洞代码不存在
5.openEuler-24.03-LTS(1.1.1m):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS-Next(1.1.1m):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(1.1.1m):不受影响-漏洞代码不存在

src-openEuler/compat-openssl11

Content Risk Flag

Comments (5)

src-openEuler/compat-openssl11 .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-6237

Comments (5)

Search

src-openEuler/compat-openssl11