Vulnerability record · CVE-2023-0286 · published 8 February 2023
CVE-2023-0286: OpenSSL X.400 GeneralName type confusion in X.509 CRL checking
OOpenssl · Openssl
OpenSSL parses X.400 addresses in an X.509 GeneralName as ASN1_STRING, but the public GENERAL_NAME structure declares the x400Address field as ASN1_TYPE, and GENERAL_NAME_cmp later interprets it as ASN1_TYPE. When CRL checking is enabled (X509_V_FLAG_CRL_CHECK), this type confusion lets an attacker pass arbitrary pointers to memcmp, causing out-of-bounds reads or a crash. It matters because certificate and CRL inputs need not be validly signed, so untrusted data can reach the vulnerable comparison.
Description
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Automated analysis
high priorityCVSS 7.4 high severity with high confidentiality and availability impact, and a very high EPSS percentile, though exploitation requires CRL checking to be enabled and specific input control.
What it is
OpenSSL parses X.400 addresses in an X.509 GeneralName as ASN1_STRING, but the public GENERAL_NAME structure declares the x400Address field as ASN1_TYPE, and GENERAL_NAME_cmp later interprets it as ASN1_TYPE. When CRL checking is enabled (X509_V_FLAG_CRL_CHECK), this type confusion lets an attacker pass arbitrary pointers to memcmp, causing out-of-bounds reads or a crash. It matters because certificate and CRL inputs need not be validly signed, so untrusted data can reach the vulnerable comparison.
Impact
An attacker can read memory contents or trigger a denial of service in applications that perform CRL checking. No code execution is described in the record.
Attack surface
Reached remotely over the network through X.509 certificate chain and CRL processing when the application sets X509_V_FLAG_CRL_CHECK; no authentication or user interaction is required per the CVSS vector. The attack generally requires the attacker to supply both the certificate chain and the CRL, or the other input must already contain an X.400 address as a CRL distribution point, which the description calls uncommon.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented; EPSS 30-day probability is 0.59501 (99.08th percentile), indicating high predicted exploitation likelihood. References are patch and vendor advisory links only, with no public exploit tag.
What to do
- Upgrade OpenSSL to a release containing the fixes referenced in the OpenSSL security advisory 20230207 and the linked git commits.
- Patch or update dependent products listed as affected (Stormshield management center and network security) per vendor guidance.
- Where immediate patching is not possible, avoid enabling X509_V_FLAG_CRL_CHECK or restrict CRL retrieval to trusted, controlled sources.
- Do not rely on signature validity of supplied certificate chains or CRLs as a control, since the flaw is reachable with unsigned inputs.
Detection
- Monitor application and service logs for crashes or abnormal terminations during TLS or certificate validation with CRL checking enabled.
- Track OpenSSL library versions across hosts and flag systems still running unpatched builds.
- Watch for unexpected or attacker-supplied CRL distribution point URLs containing X.400 addresses in certificate processing paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-0286 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-0286), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
