Invalid pointer dereference in d2i_PKCS7 functions

CVE-2023-0216

What is CVE-2023-0216?

An invalid pointer dereference occurs when applications attempt to process malformed PKCS7 data using functions such as d2i_PKCS7(), d2i_PKCS7_bio(), or d2i_PKCS7_fp(). This flaw can lead to application crashes, effectively resulting in a denial of service. While the TLS implementation in OpenSSL itself does not invoke these functions, third-party applications that handle untrusted data might be at risk.

References