git: 2b227c291f71 - main - security/vuxml: Add OpenSSL vulnerability CVE-2023-2650

Go to: [ bottom of page ] [ top of archives ] [ this month ]

From: Bernard Spil <brnrd_at_FreeBSD.org>
Date: Wed, 31 May 2023 10:43:16 UTC

The branch main has been updated by brnrd:

URL: https://cgit.FreeBSD.org/ports/commit/?id=2b227c291f717bf51ec26834f9e122586414b72f

commit 2b227c291f717bf51ec26834f9e122586414b72f
Author:     Bernard Spil <brnrd@FreeBSD.org>
AuthorDate: 2023-05-31 10:43:11 +0000
Commit:     Bernard Spil <brnrd@FreeBSD.org>
CommitDate: 2023-05-31 10:43:11 +0000

    security/vuxml: Add OpenSSL vulnerability CVE-2023-2650
---
 security/vuxml/vuln/2023.xml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index ae6abbb9399d..634afc882de5 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,42 @@
+  <vuln vid="eb9a3c57-ff9e-11ed-a0d1-84a93843eb75">
+    <topic>OpenSSL -- Possible DoS translating ASN.1 identifiers</topic>
+    <affects>
+      <package>
+	<name>openssl</name>
+	<range><lt>1.1.1u,1</lt></range>
+      </package>
+      <package>
+	<name>openssl30</name>
+	<range><lt>3.0.9</lt></range>
+      </package>
+      <package>
+	<name>openssl31</name>
+	<range><lt>3.1.1</lt></range>
+      </package>
+      <package>
+	<name>openssl-quictls</name>
+	<range><lt>3.0.9</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>The OpenSSL project reports:</p>
+	<blockquote cite="https://www.openssl.org/news/secadv/20230530.txt">
+	  <p>Severity: Moderate. Processing some specially crafted ASN.1
+	    object identifiers or data containing them may be very slow.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2023-2650</cvename>
+      <url>https://www.openssl.org/news/secadv/20230530.txt</url>
+    </references>
+    <dates>
+      <discovery>2023-05-30</discovery>
+      <entry>2023-05-31</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="79514fcd-feb4-11ed-92b5-b42e991fc52e">
     <topic>Kanboard -- Clipboard based cross-site scripting (blocked with default CSP) in Kanboard</topic>
     <affects>