Read the docs
TI-2023-00208 Aliases CVE-2023-0215GHSA-r7jw-wp68-3xch

Use-after-free following BIO_new_NDEF

Priority MEDIUM 47CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 16 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05024 92nd percentileScored 2026-11-07
Fix Partial OpenSSL (OpenSSL): 3.0.8, 1.1.1t, 1.0.2zgopenssl-src (crates.io): 111.25.0, 300.0.12Red Hat: 11 advisoriesRed Hat: 16 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSSLOpenSSL3.0.0 to before 3.0.8; 1.1.1 to before 1.1.1t; 1.0.2 to before 1.0.2zg3.0.8, 1.1.1t, 1.0.2zgPatch availableCNA
—openssl-src (crates.io)before 111.25.0111.25.0Patch availableGHSA-r7jw-wp68-3xch
—openssl-src (crates.io)300.0.0 to before 300.0.12300.0.12Patch availableGHSA-r7jw-wp68-3xch
  • OpenSSL VendorOpenSSL Affected 3.0.0 to before 3.0.8; 1.1.1 to before 1.1.1t; 1.0.2 to before 1.0.2zg Fixed in 3.0.8, 1.1.1t, 1.0.2zg Patch available CNA
  • openssl-src (crates.io) Vendor— Affected before 111.25.0 Fixed in 111.25.0 Patch available GHSA-r7jw-wp68-3xch
  • openssl-src (crates.io) Vendor— Affected 300.0.0 to before 300.0.12 Fixed in 300.0.12 Patch available GHSA-r7jw-wp68-3xch

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*1.0.2 to before 1.0.2zg; 1.1.1 to before 1.1.1t; 3.0.0 to before 3.0.8VulnerableOpenSSL
cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*before 3.3.3VulnerableStormshield
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.0.2 to before 1.0.2zg; 1.1.1 to before 1.1.1t; 3.0.0 to before 3.0.8 Vulnerable ·OpenSSL
  • cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:* Versions before 3.3.3 Vulnerable ·Stormshield

Remediation

  • Fix · CNA OpenSSL (OpenSSL) Fixed in 3.0.8, 1.1.1t, 1.0.2zg
  • Fix · GHSA-r7jw-wp68-3xch openssl-src (crates.io) Fixed in 111.25.0 Advisory →
  • Fix · GHSA-r7jw-wp68-3xch openssl-src (crates.io) Fixed in 300.0.12 Advisory →

Red Hat 11 advisories

  • RHSA-2023:4128 Released 2023-07-18 · Red Hat rating Important
    edk2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) edk2-20220126gitbb1bba3d77-2.el8_6.1, edk2-aarch64-20220126gitbb1bba3d77-2.el8_6.1, edk2-ovmf-20220126gitbb1bba3d77-2.el8_6.1
  • RHSA-2023:3420 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Web Server 5.7.3 release and security update
    • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native-1.2.31-14.redhat_14.el7jws
    • Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native-1.2.31-14.redhat_14.el8jws
    • Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native-1.2.31-14.redhat_14.el9jws
  • RHSA-2023:3421 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Web Server 5.7.3 release and security update
    • Red Hat JBoss Web Server 5
Show 8 more Red Hat advisories
  • RHSA-2023:3354 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el7jbcs +23
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el8jbcs +23
  • RHSA-2023:3355 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
    • JBCS httpd 2.4.51.sp2
  • RHSA-2023:3408 Released 2023-05-31 · Red Hat rating Moderate
    openssl security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) openssl-1:1.1.1k-9.el8_6, openssl-devel-1:1.1.1k-9.el8_6, openssl-libs-1:1.1.1k-9.el8_6 +1
  • RHSA-2023:2932 Released 2023-05-16 · Red Hat rating Important
    edk2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) edk2-20220126gitbb1bba3d77-4.el8, edk2-aarch64-20220126gitbb1bba3d77-4.el8, edk2-ovmf-20220126gitbb1bba3d77-4.el8
  • RHSA-2023:2165 Released 2023-05-09 · Red Hat rating Important
    edk2 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) edk2-20221207gitfff6d81270b5-9.el9_2, edk2-aarch64-20221207gitfff6d81270b5-9.el9_2, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2
    • Red Hat Enterprise Linux CRB (v. 9) edk2-aarch64-20221207gitfff6d81270b5-9.el9_2, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2, edk2-tools-20221207gitfff6d81270b5-9.el9_2 +1
  • RHSA-2023:1405 Released 2023-03-22 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1k-9.el8_7, openssl-devel-1:1.1.1k-9.el8_7, openssl-libs-1:1.1.1k-9.el8_7 +1
  • RHSA-2023:1199 Released 2023-03-14 · Red Hat rating Important
    openssl security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) openssl-devel-1:3.0.1-46.el9_0, openssl-perl-1:3.0.1-46.el9_0
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) openssl-1:3.0.1-46.el9_0, openssl-libs-1:3.0.1-46.el9_0
  • RHSA-2023:0946 Released 2023-02-28 · Red Hat rating Important
    openssl security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.1-47.el9_1, openssl-perl-1:3.0.1-47.el9_1
    • Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.1-47.el9_1, openssl-libs-1:3.0.1-47.el9_1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    OpenSSL — openssl.org/news/secadv/20230207.txt

    7 records Highest priority Priority HIGH 1 HIGH, 6 MEDIUM

    Other records, highest priority first

    • TI-2023-00271 X.400 address type confusion in X.509 GeneralNamePriority HIGH 70
    • TI-2022-04067 Double free after calling PEM_read_bio_exPriority MEDIUM 62
    • TI-2022-03942 Timing Oracle in RSA DecryptionPriority MEDIUM 47
    Show all 7 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
JBCS httpd 2.4.51.sp2Fixed RHSA-2023:3355
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:2932
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0946, RHSA-2023:2165
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:4128
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:1199
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:1405
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:0946
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2023:3408
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2023:1199
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2023:2165
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2023:3354
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2023:3354
Red Hat JBoss Web Server 5Fixed RHSA-2023:3421
Red Hat JBoss Web Server 5.7 for RHEL 7 ServerFixed RHSA-2023:3420
Red Hat JBoss Web Server 5.7 for RHEL 8Fixed RHSA-2023:3420
Red Hat JBoss Web Server 5.7 for RHEL 9Fixed RHSA-2023:3420
Not affected: 3 products
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Core Services on RHEL 7 Server
  • Red Hat JBoss Core Services on RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0215
  2. 2026-10-03 Alias added: GHSA-r7jw-wp68-3xch
  3. 2026-10-09 Fix available: RHSA-2023:3355 · Red Hat
  4. 2026-10-16 Fix available: JBCS httpd 2.4.51.sp2 · Red Hat

References

Patch 3

Advisory 4

Other 7

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
See all 312 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences