Incorrect cipher key & IV length processing

CVE-2023-5363

Summary

A vulnerability has been identified within OpenSSL affecting the handling of key and initialization vector (IV) lengths. This issue can lead to truncation or overrun during the initialization of various symmetric cipher modes, including RC2, RC4, RC5, CCM, GCM, and OCB. The flaw occurs when altering parameters within the OSSL_PARAM array, as changes to the key or IV lengths may go unprocessed after their establishment. In particular, a truncated IV in modes like GCM could result in IV reuse, potentially compromising confidentiality. Although the likelihood of exploitation is low due to the nature of key and IV alterations, any applications that inadvertently fall victim to this issue could face serious security implications.

References