X.400 address type confusion in X.509 GeneralName

CVE-2023-0286

Summary

A type confusion vulnerability has been identified in OpenSSL that affects how X.400 addresses are processed within an X.509 GeneralName. This issue arises due to an incorrect specification of the x400Address field type, leading to improper interpretation by the function GENERAL_NAME_cmp. When Certificate Revocation List (CRL) checking is enabled, this vulnerability allows potential attackers to manipulate memory access, which could lead to unauthorized reading of memory contents or result in a denial of service. The exploitation of this vulnerability typically requires the attacker to control both the certificate chain and CRL, although in some situations, they may only need to control one of these inputs if the other contains an X.400 address as a CRL distribution point. Thus, applications utilizing individual CRL retrieval processes are particularly susceptible to this flaw.

References