CVE-2023-0215 is a high-severity vulnerability affecting OpenSSL software, specifically versions from 1.0.2 up to 1.0.2zg, from 1.1.1 up to 1.1.1t, and from 3.0.0 up to 3.0.8. The issue is related to the public API function BIO_new_NDEF, which is primarily used internally to OpenSSL for secure communication. This vulnerability could potentially impact a wide range of systems, including web servers, email servers, virtual private networks (VPNs), and others that rely on OpenSSL for secure communication.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, check the version of OpenSSL you're using. The vulnerability affects OpenSSL versions from 1.0.2 up to 1.0.2zg, from 1.1.1 up to 1.1.1t, and from 3.0.0 up to 3.0.8. If you're using Gentoo's dev-libs/openssl package, all versions less than 3.0.10 are affected. If your OpenSSL version falls within these ranges, you could be vulnerable to this high-severity issue.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your OpenSSL software to a secure version. To do this, follow these steps: first, run the command emerge --sync in your terminal. Next, execute emerge --ask --oneshot --verbose ">=dev-libs/openssl-3.0.10". This will upgrade OpenSSL to a version that includes the necessary fixes, protecting your system from potential attacks.

Is CVE-2023-0215 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-0215 vulnerability is not explicitly mentioned as being part of CISA's Known Exploited Vulnerabilities Catalog on the provided sources. This issue is related to the public API function BIO_new_NDEF in OpenSSL and could result in a denial of service. It is important to update your OpenSSL software to a secure version, specifically to version 3.0.10 or higher, to protect your system from potential attacks.

Weakness enumeration

The Weakness Enumeration section describes a use after free error (CWE-416) in OpenSSL's BIO_new_NDEF function, which was fixed in a commit. This vulnerability could lead to a denial of service in affected systems.

For more details

CVE-2023-0215 is a high-severity vulnerability affecting OpenSSL software, with potential impacts on various systems. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links provided below.

• git.openssl.org Commit Fixing Use-After-Free Bug

• git.openssl.org Commit Diff for BIO_new_NDEF Function

• Gentoo Security Advisory for OpenSSL Vulnerabilities