UpHeron
All vulnerabilities

Servers and applications

CVE-2023-2650

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An…

Severity
Medium 6.5
Published
30 May 2023
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.0.2zh, 1.1.1u, 3.0.9, 3.1.1
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 1.0.2 before 1.0.2zh
  • From 1.1.1 before 1.1.1u
  • From 3.0.0 before 3.0.9
  • From 3.1.0 before 3.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-2650
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-2650