Search for vulnerabilities
Vulnerability details: VCID-sck3-4gk1-buca
Vulnerability ID VCID-sck3-4gk1-buca
Aliases CVE-2023-0216
GHSA-29xx-hcv2-c4cp
Summary An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-476 NULL Pointer Dereference
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0216.json
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00625 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00643 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
epss 0.00643 https://api.first.org/data/v1/epss?cve=CVE-2023-0216
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-29xx-hcv2-c4cp
cvssv3.1 7.5 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
generic_textual HIGH https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
ssvc Track https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-0216
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-0216
cvssv3.1 7.5 https://rustsec.org/advisories/RUSTSEC-2023-0011.html
generic_textual HIGH https://rustsec.org/advisories/RUSTSEC-2023-0011.html
cvssv3.1 7.5 https://security.gentoo.org/glsa/202402-08
generic_textual HIGH https://security.gentoo.org/glsa/202402-08
ssvc Track https://security.gentoo.org/glsa/202402-08
cvssv3.1 7.5 https://www.openssl.org/news/secadv/20230207.txt
generic_textual HIGH https://www.openssl.org/news/secadv/20230207.txt
ssvc Track https://www.openssl.org/news/secadv/20230207.txt
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0216.json
https://api.first.org/data/v1/epss?cve=CVE-2023-0216
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
https://nvd.nist.gov/vuln/detail/CVE-2023-0216
https://rustsec.org/advisories/RUSTSEC-2023-0011.html
https://security.gentoo.org/glsa/202402-08
https://www.openssl.org/news/secadv/20230207.txt
2164497 https://bugzilla.redhat.com/show_bug.cgi?id=2164497
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*
GHSA-29xx-hcv2-c4cp https://github.com/advisories/GHSA-29xx-hcv2-c4cp
RHSA-2023:0946 https://access.redhat.com/errata/RHSA-2023:0946
RHSA-2023:1199 https://access.redhat.com/errata/RHSA-2023:1199
USN-5844-1 https://usn.ubuntu.com/5844-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0216.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:26:43Z/ Found at https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-0216
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://rustsec.org/advisories/RUSTSEC-2023-0011.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.gentoo.org/glsa/202402-08
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:26:43Z/ Found at https://security.gentoo.org/glsa/202402-08
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.openssl.org/news/secadv/20230207.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:26:43Z/ Found at https://www.openssl.org/news/secadv/20230207.txt
Exploit Prediction Scoring System (EPSS)
Percentile 0.69272
EPSS Score 0.00625
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:37:40.788967+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/5844-1/ 37.0.0