Read the docs
TI-2023-00271 Aliases CVE-2023-0286GHSA-x4qr-2fvf-3mr5

X.400 address type confusion in X.509 GeneralName

Priority HIGH 70CWE-843Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 41 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.69286 99th percentileScored 2026-11-07
Fix Partial OpenSSL (OpenSSL): 3.0.8, 1.1.1t, 1.0.2zgcryptography (PyPI): 39.0.1+1 more productRed Hat: 25 advisoriesRed Hat: 41 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSSLOpenSSL3.0.0 to before 3.0.8; 1.1.1 to before 1.1.1t; 1.0.2 to before 1.0.2zg3.0.8, 1.1.1t, 1.0.2zgPatch availableCNA
—cryptography (PyPI)0.8.1 to before 39.0.139.0.1Patch availableGHSA-x4qr-2fvf-3mr5
—openssl-src (crates.io)before 111.25.0111.25.0Patch availableGHSA-x4qr-2fvf-3mr5
—openssl-src (crates.io)300.0.0 to before 300.0.12300.0.12Patch availableGHSA-x4qr-2fvf-3mr5
  • OpenSSL VendorOpenSSL Affected 3.0.0 to before 3.0.8; 1.1.1 to before 1.1.1t; 1.0.2 to before 1.0.2zg Fixed in 3.0.8, 1.1.1t, 1.0.2zg Patch available CNA
  • cryptography (PyPI) Vendor— Affected 0.8.1 to before 39.0.1 Fixed in 39.0.1 Patch available GHSA-x4qr-2fvf-3mr5
  • openssl-src (crates.io) Vendor— Affected before 111.25.0 Fixed in 111.25.0 Patch available GHSA-x4qr-2fvf-3mr5
  • openssl-src (crates.io) Vendor— Affected 300.0.0 to before 300.0.12 Fixed in 300.0.12 Patch available GHSA-x4qr-2fvf-3mr5

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*1.0.2 to before 1.0.2zg; 1.1.1 to before 1.1.1t; 3.0.0 to before 3.0.8VulnerableOpenSSL
cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*before 3.3.3VulnerableStormshield
cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*2.7.0 to before 2.7.11; 2.8.0 to before 3.7.34; 3.8.0 to before 3.11.22; 4.0.0 to before 4.3.16; 4.4.0 to before 4.6.3VulnerableStormshield
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.0.2 to before 1.0.2zg; 1.1.1 to before 1.1.1t; 3.0.0 to before 3.0.8 Vulnerable ·OpenSSL
  • cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:* Versions before 3.3.3 Vulnerable ·Stormshield
  • cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.11; 2.8.0 to before 3.7.34; 3.8.0 to before 3.11.22; 4.0.0 to before 4.3.16; 4.4.0 to before 4.6.3 Vulnerable ·Stormshield

Remediation

  • Fix · CNA OpenSSL (OpenSSL) Fixed in 3.0.8, 1.1.1t, 1.0.2zg
  • Fix · GHSA-x4qr-2fvf-3mr5 cryptography (PyPI) Fixed in 39.0.1 Advisory →
  • Fix · GHSA-x4qr-2fvf-3mr5 openssl-src (crates.io) Fixed in 111.25.0 Advisory →
  • Fix · GHSA-x4qr-2fvf-3mr5 openssl-src (crates.io) Fixed in 300.0.12 Advisory →

Red Hat 25 advisories

  • RHSA-2025:7937 Released 2025-05-19 · Red Hat rating Important
    compat-openssl11 security update
    • Red Hat Enterprise Linux AppStream (v. 9) compat-openssl11-1:1.1.1k-5.el9_6.1
  • RHSA-2025:7895 Released 2025-05-19 · Red Hat rating Important
    compat-openssl10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) compat-openssl10-1:1.0.2o-4.el8_10.1
  • RHSA-2025:7733 Released 2025-05-15 · Red Hat rating Important
    compat-openssl11 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) compat-openssl11-1:1.1.1k-5.el9_4.1
Show 22 more Red Hat advisories
  • RHSA-2024:6095 Released 2024-09-11 · Red Hat rating Important
    security update Logging for Red Hat OpenShift - 5.9.6
    • RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
  • RHSA-2024:5136 Released 2024-08-08 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux Server AUS (v. 7.7) openssl-1:1.0.2k-21.el7_7.1, openssl-devel-1:1.0.2k-21.el7_7.1, openssl-libs-1:1.0.2k-21.el7_7.1
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) openssl-perl-1:1.0.2k-21.el7_7.1, openssl-static-1:1.0.2k-21.el7_7.1
  • RHSA-2023:5209 Released 2023-09-19 · Red Hat rating Important
    Red Hat Virtualization Host 4.4.z SP 1 security update
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.5.3-202309130206_8.6, redhat-virtualization-host-image-update-4.5.3-202309130206_8.6
  • RHSA-2023:4252 Released 2023-07-25 · Red Hat rating Important
    edk2 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) edk2-20200602gitca407c7246bf-4.el8_4.3, edk2-ovmf-20200602gitca407c7246bf-4.el8_4.3
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) edk2-20200602gitca407c7246bf-4.el8_4.3, edk2-aarch64-20200602gitca407c7246bf-4.el8_4.3, edk2-ovmf-20200602gitca407c7246bf-4.el8_4.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) edk2-20200602gitca407c7246bf-4.el8_4.3, edk2-ovmf-20200602gitca407c7246bf-4.el8_4.3
  • RHSA-2023:4128 Released 2023-07-18 · Red Hat rating Important
    edk2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) edk2-20220126gitbb1bba3d77-2.el8_6.1, edk2-aarch64-20220126gitbb1bba3d77-2.el8_6.1, edk2-ovmf-20220126gitbb1bba3d77-2.el8_6.1
  • RHSA-2023:4124 Released 2023-07-18 · Red Hat rating Important
    edk2 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) edk2-20190829git37eef91017ad-9.el8_2.2, edk2-ovmf-20190829git37eef91017ad-9.el8_2.2
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) edk2-20190829git37eef91017ad-9.el8_2.2, edk2-ovmf-20190829git37eef91017ad-9.el8_2.2
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) edk2-20190829git37eef91017ad-9.el8_2.2, edk2-ovmf-20190829git37eef91017ad-9.el8_2.2
  • RHSA-2023:3420 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Web Server 5.7.3 release and security update
    • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native-1.2.31-14.redhat_14.el7jws
    • Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native-1.2.31-14.redhat_14.el8jws
    • Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native-1.2.31-14.redhat_14.el9jws
  • RHSA-2023:3421 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Web Server 5.7.3 release and security update
    • Red Hat JBoss Web Server 5
  • RHSA-2023:3354 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el7jbcs +23
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el8jbcs +23
  • RHSA-2023:3355 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
    • JBCS httpd 2.4.51.sp2
  • RHSA-2023:2932 Released 2023-05-16 · Red Hat rating Important
    edk2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) edk2-20220126gitbb1bba3d77-4.el8, edk2-aarch64-20220126gitbb1bba3d77-4.el8, edk2-ovmf-20220126gitbb1bba3d77-4.el8
  • RHSA-2023:2165 Released 2023-05-09 · Red Hat rating Important
    edk2 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) edk2-20221207gitfff6d81270b5-9.el9_2, edk2-aarch64-20221207gitfff6d81270b5-9.el9_2, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2
    • Red Hat Enterprise Linux CRB (v. 9) edk2-aarch64-20221207gitfff6d81270b5-9.el9_2, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2, edk2-tools-20221207gitfff6d81270b5-9.el9_2 +1
  • RHSA-2023:2022 Released 2023-04-26 · Red Hat rating Important
    edk2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) edk2-20220126gitbb1bba3d77-3.el9_0.2, edk2-aarch64-20220126gitbb1bba3d77-3.el9_0.2, edk2-ovmf-20220126gitbb1bba3d77-3.el9_0.2
  • RHSA-2023:1441 Released 2023-03-23 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) openssl-1:1.1.1k-8.el8_6, openssl-devel-1:1.1.1k-8.el8_6, openssl-libs-1:1.1.1k-8.el8_6 +1
  • RHSA-2023:1439 Released 2023-03-23 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) openssl-1:1.1.1c-21.el8_2, openssl-devel-1:1.1.1c-21.el8_2, openssl-libs-1:1.1.1c-21.el8_2 +1
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) openssl-1:1.1.1c-21.el8_2, openssl-devel-1:1.1.1c-21.el8_2, openssl-libs-1:1.1.1c-21.el8_2 +1
    • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) openssl-1:1.1.1c-21.el8_2, openssl-devel-1:1.1.1c-21.el8_2, openssl-libs-1:1.1.1c-21.el8_2 +1
  • RHSA-2023:1440 Released 2023-03-23 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.4) openssl-1:1.1.1g-18.el8_4, openssl-devel-1:1.1.1g-18.el8_4, openssl-libs-1:1.1.1g-18.el8_4 +1
  • RHSA-2023:1438 Released 2023-03-23 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux Server (v. 6 ELS) openssl-1.0.1e-61.el6_10, openssl-devel-1.0.1e-61.el6_10
    • Red Hat Enterprise Linux Server Optional (v. 6 ELS) openssl-perl-1.0.1e-61.el6_10, openssl-static-1.0.1e-61.el6_10
  • RHSA-2023:1437 Released 2023-03-23 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) openssl-1:1.1.1c-6.el8_1, openssl-devel-1:1.1.1c-6.el8_1, openssl-libs-1:1.1.1c-6.el8_1 +1
  • RHSA-2023:1405 Released 2023-03-22 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1k-9.el8_7, openssl-devel-1:1.1.1k-9.el8_7, openssl-libs-1:1.1.1k-9.el8_7 +1
  • RHSA-2023:1335 Released 2023-03-20 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.2k-26.el7_9, openssl-libs-1:1.0.2k-26.el7_9
    • Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.2k-26.el7_9, openssl-perl-1:1.0.2k-26.el7_9, openssl-static-1:1.0.2k-26.el7_9
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.2k-26.el7_9, openssl-perl-1:1.0.2k-26.el7_9, openssl-static-1:1.0.2k-26.el7_9
    • Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.2k-26.el7_9, openssl-devel-1:1.0.2k-26.el7_9, openssl-devel-1:1.0.2k-26.el7_9.ppc +2
    • Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.2k-26.el7_9, openssl-static-1:1.0.2k-26.el7_9, openssl-static-1:1.0.2k-26.el7_9.ppc
    • Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.2k-26.el7_9, openssl-devel-1:1.0.2k-26.el7_9, openssl-libs-1:1.0.2k-26.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.2k-26.el7_9, openssl-static-1:1.0.2k-26.el7_9
  • RHSA-2023:1199 Released 2023-03-14 · Red Hat rating Important
    openssl security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) openssl-devel-1:3.0.1-46.el9_0, openssl-perl-1:3.0.1-46.el9_0
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) openssl-1:3.0.1-46.el9_0, openssl-libs-1:3.0.1-46.el9_0
  • RHSA-2023:0946 Released 2023-02-28 · Red Hat rating Important
    openssl security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.1-47.el9_1, openssl-perl-1:3.0.1-47.el9_1
    • Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.1-47.el9_1, openssl-libs-1:3.0.1-47.el9_1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    OpenSSL — openssl.org/news/secadv/20230207.txt

    7 records Highest priority Priority HIGH 1 HIGH, 6 MEDIUM

    Other records, highest priority first

    • TI-2022-04067 Double free after calling PEM_read_bio_exPriority MEDIUM 62
    • TI-2023-00208 Use-after-free following BIO_new_NDEFPriority MEDIUM 47
    • TI-2022-03942 Timing Oracle in RSA DecryptionPriority MEDIUM 47
    Show all 7 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
JBCS httpd 2.4.51.sp2Fixed RHSA-2023:3355
RHOL 5.9 for RHEL 9Fixed RHSA-2024:6095
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:2932, RHSA-2025:7895
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0946, RHSA-2023:2165, RHSA-2025:7937
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2023:4124
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2023:4252
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2023:4124
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2023:4252
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:4128
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:1199, RHSA-2023:2022
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:7733
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2023:4124
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2023:4252
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:1405
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:0946
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2023:1439
Red Hat Enterprise Linux BaseOS E4S (v. 8.1)Fixed RHSA-2023:1437
Red Hat Enterprise Linux BaseOS E4S (v. 8.2)Fixed RHSA-2023:1439
Red Hat Enterprise Linux BaseOS EUS (v.8.4)Fixed RHSA-2023:1440
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2023:1441
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2023:1199
Red Hat Enterprise Linux BaseOS TUS (v. 8.2)Fixed RHSA-2023:1439
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2023:2165
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2023:1335
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2023:1335
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2023:1335
Red Hat Enterprise Linux Server (v. 6 ELS)Fixed RHSA-2023:1438
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2023:1335
Red Hat Enterprise Linux Server AUS (v. 7.7)Fixed RHSA-2024:5136
Red Hat Enterprise Linux Server Optional (v. 6 ELS)Fixed RHSA-2023:1438
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2023:1335
Red Hat Enterprise Linux Server Optional AUS (v. 7.7)Fixed RHSA-2024:5136
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2023:1335
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2023:1335
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2023:3354
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2023:3354
Red Hat JBoss Web Server 5Fixed RHSA-2023:3421
Red Hat JBoss Web Server 5.7 for RHEL 7 ServerFixed RHSA-2023:3420
Red Hat JBoss Web Server 5.7 for RHEL 8Fixed RHSA-2023:3420
Red Hat JBoss Web Server 5.7 for RHEL 9Fixed RHSA-2023:3420
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2023:5209
Not affected: 5 products
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Core Services on RHEL 7 Server
  • Red Hat JBoss Core Services on RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0286
  2. 2026-10-03 Alias added: GHSA-x4qr-2fvf-3mr5
  3. 2026-10-09 Fix available: RHSA-2023:3355 · Red Hat
  4. 2026-10-16 Fix available: JBCS httpd 2.4.51.sp2 · Red Hat

References

Patch 3

Advisory 4

Other 6

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
See all 312 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences