CVE-2023-2650

/// Technical description

Issue summary: Processing some specially crafted ASN.1 object identifiers or

data containing them may be very slow.

Impact summary: Applications that use OBJ_obj2txt() directly, or use any of

the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message

size limit may experience notable to very long delays when processing those

messages, which may lead to a Denial of Service.

An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -

most of which have no size limit. OBJ_obj2txt() may be used to translate

an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL

type ASN1_OBJECT) to its canonical numeric text form, which are the

sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by

periods.

When one of the sub-identifiers in the OBJECT IDENTIFIER is very large

(these are sizes that are seen as absurdly large, taking up tens or hundreds

of KiBs), the translation to a decimal number in text may take a very long

time. T

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References