CVE-2023-0286X.400 address type confusion in X.509 GeneralName
Updated under an hour ago ()
Does this affect you?
It affects OpenSSL and 11 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
- CVSS
- 7.4 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- CWE-843
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openssl
- NVD analysis
- Modified
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
OpenSSL OpenSSL openssl:openssl (from the name) | from 3.0.0 before 3.0.8; from 1.1.1 before 1.1.1t; from 1.0.2 before 1.0.2zg | CNA record |
Siemens BFCClient siemens:bfcclient (from the name) | before V2.17 | CISA ADP |
Siemens RUGGEDCOM APE1808 siemens:ruggedcom_ape1808 (from the name) | all versions | CISA ADP |
Siemens SCALANCE W1750D (JP) siemens:scalance_w1750d_jp (from the name) | before V8.10.0.9 | CISA ADP |
Siemens SCALANCE W1750D (ROW) siemens:scalance_w1750d_row (from the name) | before V8.10.0.9 | CISA ADP |
Siemens SCALANCE W1750D (USA) siemens:scalance_w1750d_usa (from the name) | before V8.10.0.9 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | before V1.1 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
openssl openssl openssl:openssl | from 1.0.2 before 1.0.2zg; from 1.1.1 before 1.1.1t; from 3.0.0 before 3.0.8 | NVD |
stormshield stormshield_management_center stormshield:stormshield_management_center | before 3.3.3 | NVD |
stormshield stormshield_network_security stormshield:stormshield_network_security | from 2.7.0 before 2.7.11; from 2.8.0 before 3.7.34; from 3.8.0 before 3.11.22; from 4.0.0 before 4.3.16; from 4.4.0 before 4.6.3 | NVD |
References
- https://www.openssl.org/news/secadv/20230207.txtvendor-advisory
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658patch, vendor-advisory
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9patch, vendor-advisory
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4dpatch, vendor-advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sigthird-party-advisory
- https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txtthird-party-advisory
- https://security.gentoo.org/glsa/202402-08
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003
- https://cert-portal.siemens.com/productcert/html/ssa-028723.html
- https://cert-portal.siemens.com/productcert/html/ssa-203374.html
- https://cert-portal.siemens.com/productcert/html/ssa-264815.html
- https://cert-portal.siemens.com/productcert/html/ssa-337522.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-455250.html
- https://cert-portal.siemens.com/productcert/html/ssa-556635.html
- https://cert-portal.siemens.com/productcert/html/ssa-561322.html
- https://cert-portal.siemens.com/productcert/html/ssa-625862.html
- https://cert-portal.siemens.com/productcert/html/ssa-769027.html
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
- https://cert-portal.siemens.com/productcert/html/ssa-879734.html
- https://cert-portal.siemens.com/productcert/html/ssa-943925.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.