NULL dereference validating DSA public key

CVE-2023-0217

Summary

An invalid pointer dereference can occur when the EVP_PKEY_public_check() function processes a malformed DSA public key. Should an application utilize this function with public keys from untrusted sources, it may lead to application crashes or denial of service. While the TLS implementation in OpenSSL does not invoke this function, applications meeting stringent security standards, such as FIPS 140-3, might engage the function, exposing them to potential disruptions.

References