{"schema_version":"1.9.0","id":"CVE-2023-3817","published":"2023-07-31T15:34:13.627Z","modified":"2026-08-12T03:51:13.646532875Z","related":["ALSA-2023:7877","ALSA-2024:2447","CGA-hxqv-3m45-8f6g","SUSE-SU-2023:3239-1","SUSE-SU-2023:3242-1","SUSE-SU-2023:3243-1","SUSE-SU-2023:3244-1","SUSE-SU-2023:3244-2","SUSE-SU-2023:3291-1","SUSE-SU-2023:3291-2","SUSE-SU-2023:3308-1","SUSE-SU-2023:3338-1","SUSE-SU-2023:3339-1","SUSE-SU-2023:3397-1","SUSE-SU-2023:3958-1","SUSE-SU-2023:4189-1","SUSE-SU-2023:4190-1","openSUSE-SU-2024:13090-1","openSUSE-SU-2024:13097-1","openSUSE-SU-2024:13111-1"],"summary":"Excessive time spent checking DH q parameter value","details":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"89cd17a031e022211684eb7eb41190cf1910f9fa"},{"fixed":"245cb0291e0db99d9ccf3692fa76f440b2b054c2"},{"introduced":"a92271e03a8d0dee507b6f1e7f49512568b2c7ad"},{"fixed":"17a2c5111864d8e016c5f2d29c40a3746b559e9d"},{"introduced":"e818b74be2170fbe957a07b0da4401c2b694b3b8"},{"last_affected":"bb20b3fd507b635607eddd895dbcad08e0ed8793"}],"database_specific":{"cpe":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2:-:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2n:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2o:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2p:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2q:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2r:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2s:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2t:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2u:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2v:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2w:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2x:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2y:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2za:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2zb:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2zc:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2zd:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2ze:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2zf:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2zg:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2zh:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:-:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1a:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1b:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1c:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1d:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1e:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1f:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1g:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1h:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1i:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1j:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1l:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1m:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1n:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1o:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1p:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1r:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1s:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1t:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1u:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:pre1:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:pre2:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:pre3:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:pre4:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:pre5:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:pre6:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:pre7:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:pre8:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.1:pre9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.0.0"},{"fixed":"3.0.10"},{"introduced":"3.1.0"},{"fixed":"3.1.2"},{"introduced":"1.0.2-NA"},{"last_affected":"1.0.2-NA"},{"introduced":"1.0.2a"},{"last_affected":"1.0.2a"},{"introduced":"1.0.2b"},{"last_affected":"1.0.2b"},{"introduced":"1.0.2c"},{"last_affected":"1.0.2c"},{"introduced":"1.0.2d"},{"last_affected":"1.0.2d"},{"introduced":"1.0.2e"},{"last_affected":"1.0.2e"},{"introduced":"1.0.2f"},{"last_affected":"1.0.2f"},{"introduced":"1.0.2g"},{"last_affected":"1.0.2g"},{"introduced":"1.0.2h"},{"last_affected":"1.0.2h"},{"introduced":"1.0.2i"},{"last_affected":"1.0.2i"},{"introduced":"1.0.2j"},{"last_affected":"1.0.2j"},{"introduced":"1.0.2k"},{"last_affected":"1.0.2k"},{"introduced":"1.0.2l"},{"last_affected":"1.0.2l"},{"introduced":"1.0.2m"},{"last_affected":"1.0.2m"},{"introduced":"1.0.2n"},{"last_affected":"1.0.2n"},{"introduced":"1.0.2o"},{"last_affected":"1.0.2o"},{"introduced":"1.0.2p"},{"last_affected":"1.0.2p"},{"introduced":"1.0.2q"},{"last_affected":"1.0.2q"},{"introduced":"1.0.2r"},{"last_affected":"1.0.2r"},{"introduced":"1.0.2s"},{"last_affected":"1.0.2s"},{"introduced":"1.0.2t"},{"last_affected":"1.0.2t"},{"introduced":"1.0.2u"},{"last_affected":"1.0.2u"},{"introduced":"1.0.2v"},{"last_affected":"1.0.2v"},{"introduced":"1.0.2w"},{"last_affected":"1.0.2w"},{"introduced":"1.0.2x"},{"last_affected":"1.0.2x"},{"introduced":"1.0.2y"},{"last_affected":"1.0.2y"},{"introduced":"1.0.2za"},{"last_affected":"1.0.2za"},{"introduced":"1.0.2zb"},{"last_affected":"1.0.2zb"},{"introduced":"1.0.2zc"},{"last_affected":"1.0.2zc"},{"introduced":"1.0.2zd"},{"last_affected":"1.0.2zd"},{"introduced":"1.0.2ze"},{"last_affected":"1.0.2ze"},{"introduced":"1.0.2zf"},{"last_affected":"1.0.2zf"},{"introduced":"1.0.2zg"},{"last_affected":"1.0.2zg"},{"introduced":"1.0.2zh"},{"last_affected":"1.0.2zh"},{"introduced":"1.0.2-beta1"},{"last_affected":"1.0.2-beta1"},{"introduced":"1.0.2-beta2"},{"last_affected":"1.0.2-beta2"},{"introduced":"1.0.2-beta3"},{"last_affected":"1.0.2-beta3"},{"introduced":"1.1.1-NA"},{"last_affected":"1.1.1-NA"},{"introduced":"1.1.1a"},{"last_affected":"1.1.1a"},{"introduced":"1.1.1b"},{"last_affected":"1.1.1b"},{"introduced":"1.1.1c"},{"last_affected":"1.1.1c"},{"introduced":"1.1.1d"},{"last_affected":"1.1.1d"},{"introduced":"1.1.1e"},{"last_affected":"1.1.1e"},{"introduced":"1.1.1f"},{"last_affected":"1.1.1f"},{"introduced":"1.1.1g"},{"last_affected":"1.1.1g"},{"introduced":"1.1.1h"},{"last_affected":"1.1.1h"},{"introduced":"1.1.1i"},{"last_affected":"1.1.1i"},{"introduced":"1.1.1j"},{"last_affected":"1.1.1j"},{"introduced":"1.1.1k"},{"last_affected":"1.1.1k"},{"introduced":"1.1.1l"},{"last_affected":"1.1.1l"},{"introduced":"1.1.1m"},{"last_affected":"1.1.1m"},{"introduced":"1.1.1n"},{"last_affected":"1.1.1n"},{"introduced":"1.1.1o"},{"last_affected":"1.1.1o"},{"introduced":"1.1.1p"},{"last_affected":"1.1.1p"},{"introduced":"1.1.1q"},{"last_affected":"1.1.1q"},{"introduced":"1.1.1r"},{"last_affected":"1.1.1r"},{"introduced":"1.1.1s"},{"last_affected":"1.1.1s"},{"introduced":"1.1.1t"},{"last_affected":"1.1.1t"},{"introduced":"1.1.1u"},{"last_affected":"1.1.1u"},{"introduced":"1.1.1-pre1"},{"last_affected":"1.1.1-pre1"},{"introduced":"1.1.1-pre2"},{"last_affected":"1.1.1-pre2"},{"introduced":"1.1.1-pre3"},{"last_affected":"1.1.1-pre3"},{"introduced":"1.1.1-pre4"},{"last_affected":"1.1.1-pre4"},{"introduced":"1.1.1-pre5"},{"last_affected":"1.1.1-pre5"},{"introduced":"1.1.1-pre6"},{"last_affected":"1.1.1-pre6"},{"introduced":"1.1.1-pre7"},{"last_affected":"1.1.1-pre7"},{"introduced":"1.1.1-pre8"},{"last_affected":"1.1.1-pre8"},{"introduced":"1.1.1-pre9"},{"last_affected":"1.1.1-pre9"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["1.0.2-NA","1.0.2-beta1","1.0.2-beta2","1.0.2-beta3","1.1.1-NA","1.1.1-pre1","1.1.1-pre2","1.1.1-pre3","1.1.1-pre4","1.1.1-pre5","1.1.1-pre6","1.1.1-pre7","1.1.1-pre8","1.1.1-pre9","openssl-3.0.9","openssl-3.1.1","openssl-3.1.0","openssl-3.0.8","openssl-3.0.7","openssl-3.0.6","openssl-3.0.5","openssl-3.0.4","openssl-3.0.3","openssl-3.0.2","openssl-3.0.1","openssl-3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3817.json"}}],"references":[{"type":"WEB","url":"http://seclists.org/fulldisclosure/2023/Jul/43"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/07/31/1"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/09/22/11"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/09/22/9"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/11/06/2"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3817.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3817"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202402-08"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20230818-0014/"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20231027-0008/"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240621-0006/"},{"type":"ADVISORY","url":"https://www.openssl.org/news/secadv/20230731.txt"},{"type":"FIX","url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"},{"type":"FIX","url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"},{"type":"FIX","url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"},{"type":"FIX","url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5"}],"database_specific":{"cna_assigner":"openssl","cwe_ids":["CWE-606"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3817.json","unresolved_ranges":[{"extracted_events":[{"introduced":"3.1.0"},{"fixed":"3.1.2"},{"introduced":"3.0.0"},{"fixed":"3.0.10"},{"introduced":"1.1.1"},{"fixed":"1.1.1v"},{"introduced":"1.0.2"},{"fixed":"1.0.2zi"}],"source":"AFFECTED_FIELD"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}