U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2023-3817 Detail

Description

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
http://seclists.org/fulldisclosure/2023/Jul/43 CVE
http://www.openwall.com/lists/oss-security/2023/07/31/1 CVE
http://www.openwall.com/lists/oss-security/2023/09/22/11 CVE
http://www.openwall.com/lists/oss-security/2023/09/22/9 CVE
http://www.openwall.com/lists/oss-security/2023/11/06/2 CVE
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5 CVE, OpenSSL Software Foundation Mailing List  Patch 
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644 CVE, OpenSSL Software Foundation Broken Link 
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f CVE, OpenSSL Software Foundation Mailing List  Patch 
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5 CVE, OpenSSL Software Foundation Mailing List  Patch 
https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html CVE
https://security.gentoo.org/glsa/202402-08 CVE
https://security.netapp.com/advisory/ntap-20230818-0014/ CVE
https://security.netapp.com/advisory/ntap-20231027-0008/ CVE
https://security.netapp.com/advisory/ntap-20240621-0006/ CVE
https://www.openssl.org/news/secadv/20230731.txt CVE, OpenSSL Software Foundation Vendor Advisory 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-834 Excessive Iteration cwe source acceptance level NIST  
CWE-606 Unchecked Input for Loop Condition OpenSSL Software Foundation  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

17 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2023-3817
NVD Published Date:
07/31/2023
NVD Last Modified:
06/17/2026
Source:
OpenSSL Software Foundation