Search for vulnerabilities
Vulnerability details: VCID-64cj-3d84-aaaa
Vulnerability ID VCID-64cj-3d84-aaaa
Aliases CVE-2023-0216
GHSA-29xx-hcv2-c4cp
Summary An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-476 NULL Pointer Dereference
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0216.json
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00187 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00778 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00799 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00799 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.01307 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-29xx-hcv2-c4cp
cvssv3.1 7.5 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
generic_textual HIGH https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
ssvc Track https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-0216
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-0216
cvssv3.1 7.5 https://rustsec.org/advisories/RUSTSEC-2023-0011.html
generic_textual HIGH https://rustsec.org/advisories/RUSTSEC-2023-0011.html
cvssv3.1 7.5 https://security.gentoo.org/glsa/202402-08
ssvc Track https://security.gentoo.org/glsa/202402-08
cvssv3.1 7.4 https://www.openssl.org/news/secadv/20230207.txt
cvssv3.1 7.5 https://www.openssl.org/news/secadv/20230207.txt
generic_textual HIGH https://www.openssl.org/news/secadv/20230207.txt
ssvc Track https://www.openssl.org/news/secadv/20230207.txt
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0216.json
https://api.first.org/data/v1/epss?cve=CVE-2023-0216
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
https://rustsec.org/advisories/RUSTSEC-2023-0011.html
https://www.openssl.org/news/secadv/20230207.txt
2164497 https://bugzilla.redhat.com/show_bug.cgi?id=2164497
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*
CVE-2023-0216 https://nvd.nist.gov/vuln/detail/CVE-2023-0216
GHSA-29xx-hcv2-c4cp https://github.com/advisories/GHSA-29xx-hcv2-c4cp
GLSA-202402-08 https://security.gentoo.org/glsa/202402-08
RHSA-2023:0946 https://access.redhat.com/errata/RHSA-2023:0946
RHSA-2023:1199 https://access.redhat.com/errata/RHSA-2023:1199
USN-5844-1 https://usn.ubuntu.com/5844-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0216.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:26:43Z/ Found at https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-0216
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-0216
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://rustsec.org/advisories/RUSTSEC-2023-0011.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.gentoo.org/glsa/202402-08
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:26:43Z/ Found at https://security.gentoo.org/glsa/202402-08
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://www.openssl.org/news/secadv/20230207.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.openssl.org/news/secadv/20230207.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:26:43Z/ Found at https://www.openssl.org/news/secadv/20230207.txt
Exploit Prediction Scoring System (EPSS)
Percentile 0.56777
EPSS Score 0.00187
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.