CVE-2023-0217

A flaw was found in OpenSSL. An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function, most likely leading to an application crash. This function can be called on public keys supplied from untrusted sources, which could allow an attacker to cause a denial of service.

Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of shim as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.