CVE-2024-4603

/// Technical description

Issue summary: Checking excessively long DSA keys or parameters may be very

slow.

Impact summary: Applications that use the functions EVP_PKEY_param_check()

or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may

experience long delays. Where the key or parameters that are being checked

have been obtained from an untrusted source this may lead to a Denial of

Service.

The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform

various checks on DSA parameters. Some of those computations take a long time

if the modulus (`p` parameter) is too large.

Trying to use a very large modulus is slow and OpenSSL will not allow using

public keys with a modulus which is over 10,000 bits in length for signature

verification. However the key and parameter check functions do not limit

the modulus size when performing the checks.

An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()

and supplies a key or parameters obtained from an untrusted sourc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References