Junglewise Threat Intelligence

CVE-2024-6119: OpenSSL denial of service in certificate name checking

CVE-2024-6119 · Severity: high · CVSS 7.5 · Published 2024-09-03

Technologies: OpenSSL. Vendors: OpenSSL.

Executive brief

OpenSSL is a widely used security library that enables encrypted communications for websites and applications. A vulnerability in how it verifies digital certificates can cause an application to crash when it encounters a specially crafted certificate. This could allow an attacker to disrupt services or take down applications that rely on OpenSSL for secure connections.

Technical details

A type confusion vulnerability exists in OpenSSL's certificate name checking logic. When an application (typically a TLS client) validates a certificate and specifies an expected DNS name, IP address, or email, OpenSSL may incorrectly handle the 'otherName' field in the Subject Alternative Name (SAN) extension. Specifically, the code may attempt to access a union member in the GENERAL_NAME structure that does not match the actual type, leading to an invalid memory read and a segmentation fault. This issue affects OpenSSL versions 3.0 through 3.3, but does not impact the FIPS modules. Patches are available in versions 3.0.15, 3.1.7, 3.2.3, and 3.3.2.

Affected products

  • OpenSSL OpenSSL 3.0.0 to 3.0.14, 3.1.0 to 3.1.6, 3.2.0 to 3.2.2, 3.3.0 to 3.3.1

Timeline

  • 2024-09-03: advisory: OpenSSL security advisory published
  • 2024-09-03: patched: Fixes committed to OpenSSL repository

References

Related threats