OpenSSL-Universal-1.1.1100: 1 vulnerabilities (highest severity is: 7.4) - autoclosed

[mend-for-github-com]

Vulnerable Library - OpenSSL-Universal-1.1.1100

OpenSSL is an SSL/TLS and Crypto toolkit. Deprecated in Mac OS and gone in iOS, this spec gives your project non-deprecated OpenSSL support. Supports OSX and iOS including Simulator (armv7,armv7s,arm64,x86_64).

Library home page: https://github.com/krzyzanowskim/OpenSSL/archive/1.1.1100.zip

Path to dependency file: /BasicVideoChat/ios/Podfile.lock

Path to vulnerable library: /BasicVideoChat/ios/Podfile.lock,/Signaling/ios/Podfile.lock,/BasicVideoChat/ios/Podfile.lock,/Signaling/ios/Podfile.lock

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (OpenSSL-Universal version)	Remediation Available
CVE-2023-0286	High	7.4	OpenSSL-Universal-1.1.1100	Direct	openssl-3.0.8, OpenSSL_1_1_1t	❌

Details

CVE-2023-0286

Vulnerable Library - OpenSSL-Universal-1.1.1100

OpenSSL is an SSL/TLS and Crypto toolkit. Deprecated in Mac OS and gone in iOS, this spec gives your project non-deprecated OpenSSL support. Supports OSX and iOS including Simulator (armv7,armv7s,arm64,x86_64).

Library home page: https://github.com/krzyzanowskim/OpenSSL/archive/1.1.1100.zip

Path to dependency file: /BasicVideoChat/ios/Podfile.lock

Path to vulnerable library: /BasicVideoChat/ios/Podfile.lock,/Signaling/ios/Podfile.lock,/BasicVideoChat/ios/Podfile.lock,/Signaling/ios/Podfile.lock

Dependency Hierarchy:

• ❌ OpenSSL-Universal-1.1.1100 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Publish Date: 2023-02-08

URL: CVE-2023-0286

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.openssl.org/news/vulnerabilities.html

Release Date: 2023-02-08

Fix Resolution: openssl-3.0.8, OpenSSL_1_1_1t

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.