CVE-2023-3817

一、漏洞信息
 漏洞编号：[CVE-2023-3817](https://nvd.nist.gov/vuln/detail/CVE-2023-3817)
 漏洞归属组件：[openresty-openssl111](https://gitee.com/src-openeuler/openresty-openssl111)
 漏洞归属的版本：1.1.1h
 CVSS V3.0分值：
  BaseScore：5.3 Medium
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
 漏洞简述：
  Issue summary: Checking excessively long DH keys or parameters may be very slow.Impact summary: Applications that use the functions DH_check(), DH_check_ex()or EVP_PKEY_param_check() to check a DH key or DH parameters may experience longdelays. Where the key or parameters that are being checked have been obtainedfrom an untrusted source this may lead to a Denial of Service.The function DH_check() performs various checks on DH parameters. After fixingCVE-2023-3446 it was discovered that a large q parameter value can also triggeran overly long computation during some of these checks. A correct q value,if present, cannot be larger than the modulus p parameter, thus it isunnecessary to perform these checks if q is larger than p.An application that calls DH_check() and supplies a key or parameters obtainedfrom an untrusted source could be vulnerable to a Denial of Service attack.The function DH_check() is itself called by a number of other OpenSSL functions.An application calling any of those other functions may similarly be affected.The other functions affected by this are DH_check_ex() andEVP_PKEY_param_check().Also vulnerable are the OpenSSL dhparam and pkeyparam command line applicationswhen using the  -check  option.The OpenSSL SSL/TLS implementation is not affected by this issue.The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
 漏洞公开时间：2023-08-01 00:15:10
 漏洞创建时间：2025-06-09 14:15:05
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-3817
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://www.suse.com/security/cve/CVE-2023-3817/ |  |
|  | https://www.openssl.org/news/secadv/20230731.txt |  |
|  | https://bugzilla.suse.com/1216163 |  |
|  | https://security-tracker.debian.org/tracker/CVE-2023-3817 |  |
|  | https://gitee.com/openharmony/third_party_openssl/pulls/131 |  |
|  | https://github.com/openssl/openssl/commit/91ddeba0f2269b017dc06c46c993a788974b1aa5 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.6840 |  |
|  | https://bugzilla.suse.com/1216922 |  |
|  | https://access.redhat.com/errata/RHSA-2024:2447 |  |
|  | https://cxsecurity.com/cveshow/CVE-2023-3817/ |  |
|  | https://bugzilla.suse.com/1213853 |  |
|  | https://access.redhat.com/errata/RHSA-2023:7877 |  |
|  | https://lists.suse.com/pipermail/sle-security-updates/2023-October/016510.html |  |
|  | https://www.debian.org/lts/security/2023/dla-3530 |  |
|  | https://www.suse.com/support/security/rating/ |  |
|  | https://errata.almalinux.org/8/ALSA-2023-7877.html |  |
|  | https://www.suse.com/support/update/announcement/2023/suse-su-20233291-2/ |  |
|  | https://access.redhat.com/security/cve/CVE-2023-5678 |  |
|  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5 |  |
|  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644 |  |
|  | https://www.suse.com/security/cve/CVE-2023-5363/ |  |
|  | https://ubuntu.com/security/CVE-2023-5678 |  |
|  | http://www.openwall.com/lists/oss-security/2023/11/06/2 |  |
|  | https://lists.suse.com/pipermail/sle-security-updates/2023-October/016835.html |  |
|  | https://www.oracle.com/security-alerts/cpujan2024.html |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.4756 |  |
|  | https://www.mend.io/vulnerability-database/CVE-2023-3817 |  |
|  | https://www.suse.com/security/cve/CVE-2023-3817.html |  |
|  | http://www.openwall.com/lists/oss-security/2023/09/22/9 |  |
|  | https://bugzilla.redhat.com/2248616 |  |
|  | http://seclists.org/fulldisclosure/2023/Jul/43 |  |
|  | https://ubuntu.com/security/notices/USN-6435-2 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3817 |  |
|  | https://www.oracle.com/security-alerts/cpujul2024.html |  |
|  | https://www.oracle.com/security-alerts/cpuapr2024.html |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.4381 |  |
|  | https://bugzilla.suse.com/1213517 |  |
|  | https://security.netapp.com/advisory/ntap-20230818-0014/ |  |
|  | https://gitee.com/openharmony/third_party_openssl/pulls/130 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2024.0271 |  |
|  | https://linux.oracle.com/errata/ELSA-2023-7877.html |  |
|  | https://github.com/openssl/openssl/commit/1c16253f3c3a8d1e25918c3f404aae6a5b0893de |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.6347 |  |
|  | https://lists.suse.com/pipermail/sle-security-updates/2023-October/016834.html |  |
|  | https://gitee.com/openharmony/third_party_openssl/pulls/132 |  |
|  | https://security.gentoo.org/glsa/202402-08 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2023-3817 |  |
|  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f |  |
|  | https://ubuntu.com/security/notices/USN-6709-1 |  |
|  | https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html |  |
|  | https://www.suse.com/support/update/announcement/2023/suse-su-20234189-1/ |  |
|  | https://www.oracle.com/security-alerts/cpuoct2023.html |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.6263 |  |
|  | https://errata.almalinux.org/9/ALSA-2024-2447.html |  |
|  | http://people.ubuntu.com/~ubuntu-security/cve/CVE-2023-3817 |  |
|  | https://linux.oracle.com/cve/CVE-2023-3817.html |  |
|  | https://security.netapp.com/advisory/ntap-20240621-0006/ |  |
|  | http://www.openwall.com/lists/oss-security/2023/07/31/1 |  |
|  | https://lists.suse.com/pipermail/sle-updates/2023-August/031059.html |  |
|  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5 |  |
|  | https://ubuntu.com/security/notices/USN-6435-1 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3817 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2227852 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.7604 |  |
|  | https://gitee.com/openharmony/third_party_openssl |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2023-3817 |  |
|  | https://ubuntu.com/security/CVE-2023-3817 |  |
|  | https://bugzilla.redhat.com/2224962 |  |
|  | https://ubuntu.com/security/CVE-2023-3446 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.4604 |  |
|  | https://github.com/pyca/cryptography/commit/b22271cf3c3dd8dc8978f8f4b00b5c7060b6538d |  |
|  | https://access.redhat.com/security/cve/CVE-2023-3446 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.6191 |  |
|  | https://access.redhat.com/security/cve/CVE-2023-3817 |  |
|  | http://www.openwall.com/lists/oss-security/2023/09/22/11 |  |
|  | https://ubuntu.com/security/notices/USN-6450-1 |  |
|  | https://www.suse.com/support/update/announcement/2023/suse-su-20234190-1/ |  |
|  | https://www.suse.com/support/update/announcement/2023/suse-su-20233338-1/ |  |
|  | https://linux.oracle.com/errata/ELSA-2024-12056.html |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.4592 |  |
|  | https://bugzilla.redhat.com/2227852 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.7320 |  |
|  | https://security.netapp.com/advisory/ntap-20231027-0008/ |  |
|  | https://access.redhat.com/security/cve/cve-2023-3817 |  |
|  | https://ubuntu.com/security/CVE-2024-0727 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2024.0366 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其他
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| openssl/openssl |  | https://github.com/openssl/openssl/commit/1c16253f3c3a8d1e25918c3f404aae6a5b0893de.patch |  | ljqc |
| openssl/openssl |  | https://github.com/openssl/openssl/commit/869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644.patch |  | ljqc |
|  |  | https://github.com/openssl/openssl/commit/91ddeba0f2269b017dc06c46c993a788974b1aa5 |  | snyk |
|  |  | https://github.com/openssl/openssl/commit/1c16253f3c3a8d1e25918c3f404aae6a5b0893de |  | snyk |
|  |  | https://github.com/pyca/cryptography/commit/b22271cf3c3dd8dc8978f8f4b00b5c7060b6538d |  | snyk |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                                         
 openEuler评分：
  5.3
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
 受影响版本排查(受影响/不受影响)：
  1.master(1.1.1h):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3(1.1.1h):
4.openEuler-22.03-LTS-SP4(1.1.1h):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

修复是否涉及abi变化(是/否)：
  1.master(1.1.1h):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3(1.1.1h):
4.openEuler-22.03-LTS-SP4(1.1.1h):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

原因说明：
  1.master(1.1.1h):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3(1.1.1h):
4.openEuler-22.03-LTS-SP4(1.1.1h):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

src-openEuler/openresty-openssl111

内容风险标识

评论 (3)

src-openEuler/openresty-openssl111 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-3817

评论 (3)

搜索帮助

src-openEuler/openresty-openssl111