CVE-2023-35784

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35784
A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt Release Notes
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt Release Notes
https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig Patch
https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig Patch
https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openbsd:libressl:*:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:libressl:*:*:*:*:*:*:*:*
cpe:2.3:o:openbsd:openbsd:7.2:*:*:*:*:*:*:*
cpe:2.3:o:openbsd:openbsd:7.3:*:*:*:*:*:*:*
History

06 Nov 2023, 22:15

Type Values Removed Values Added
References
  • {'url': 'https://github.com/libressl/openbsd/commit/1d6680b3682f8caba78c627dee60c76da6e20dd7', 'name': 'https://github.com/libressl/openbsd/commit/1d6680b3682f8caba78c627dee60c76da6e20dd7', 'tags': ['Patch'], 'refsource': 'MISC'}
  • {'url': 'https://github.com/libressl/openbsd/commit/96094ca8757b95298f49d65c813f303bd514b27b', 'name': 'https://github.com/libressl/openbsd/commit/96094ca8757b95298f49d65c813f303bd514b27b', 'tags': ['Patch'], 'refsource': 'MISC'}
  • (MISC) https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54 -

26 Jun 2023, 22:16

Type Values Removed Values Added
CWE CWE-415
CWE-416
CPE cpe:2.3:o:openbsd:openbsd:7.2:*:*:*:*:*:*:*
cpe:2.3:o:openbsd:openbsd:7.3:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:libressl:*:*:*:*:*:*:*:*
First Time Openbsd
Openbsd openbsd
Openbsd libressl
References (MISC) https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig - (MISC) https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig - Patch
References (MISC) https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt - (MISC) https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt - Release Notes
References (MISC) https://github.com/libressl/openbsd/commit/96094ca8757b95298f49d65c813f303bd514b27b - (MISC) https://github.com/libressl/openbsd/commit/96094ca8757b95298f49d65c813f303bd514b27b - Patch
References (MISC) https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt - (MISC) https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt - Release Notes
References (MISC) https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig - (MISC) https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig - Patch
References (MISC) https://github.com/libressl/openbsd/commit/1d6680b3682f8caba78c627dee60c76da6e20dd7 - (MISC) https://github.com/libressl/openbsd/commit/1d6680b3682f8caba78c627dee60c76da6e20dd7 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

16 Jun 2023, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-16 20:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-35784

Mitre link : CVE-2023-35784

CVE.ORG link : CVE-2023-35784

JSON object : View

Products Affected

openbsd

  • libressl
  • openbsd
CWE
CWE-415

Double Free

CWE-416

Use After Free