Vulnerability in Openssl
CVE-2023-3446
Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience lon…
EPSS: 0.010 (77.6th percentile) — read the EPSS interpretation.
Affected products
- Openssl — versions 3.1.0, 3.0.0, 1.1.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- OpenSSL Advisory (vendor-advisory)
- 3.1.2 git commit (patch)
- 3.0.10 git commit (patch)
- 1.1.1v git commit (patch)
- 1.0.2zi patch (premium) (patch)
Frequently asked questions
- What is CVE-2023-3446?
- CVE-2023-3446 is a vulnerability in Openssl, classified under CWE-606. Published 2023-07-19.
- Is CVE-2023-3446 known to be exploited?
- 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.