Уязвимость DoS атаки в OpenSSL из-за некорректного сравнения имен типа EDIPartyName
Описание
Функция GENERAL_NAME_cmp в OpenSSL некорректно сравнивает два экземпляра типа GENERAL_NAME, если оба содержат EDIPARTYNAME. Это может привести к разыменованию NULL указателя и аварийному завершению работы, что дает возможность злоумышленнику осуществить DoS атаку. OpenSSL использует функцию GENERAL_NAME_cmp в двух случаях:
- При сравнении имён точек распространения CRL между доступным CRL и точкой распространения CRL, встроенной в сертификат X509.
- При верификации, что подписант токена ответа метки времени соответствует имени органа выдачи меток времени (доступно через API-функции
TS_RESP_verify_responseиTS_RESP_verify_token).
Если злоумышленник может контролировать оба элемента, которые сравниваются, то он способен вызвать аварийное завершение работы, например, путем обмана клиента или сервера для проверки вредоносного сертификата.
Затронутое ПО
- OpenSSL
Тип уязвимости
DoS атака
Ссылки
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- PatchThird Party Advisory
- PatchThird Party Advisory
Уязвимые конфигурации
Одно из
Одно из
Одно из
Одно из
Одно из
Одновременно
Одновременно
Одно из
Одно из
EPSS
5.9 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious...
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious...
The X.509 GeneralName type is a generic type for representing differen ...
EPSS
5.9 Medium
CVSS3
4.3 Medium
CVSS2