CVE-2023-2975
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Summary
CVE-2023-2975 is a low severity vulnerability affecting the OpenSSL implementation of the AES-SIV cipher. The issue arises when the algorithm ignores empty, unauthenticated associated data entries during the authentication process. Applications that use AES-SIV to authenticate empty data entries as associated data may be susceptible to data manipulation, as the OpenSSL implementation will not perform the expected authentication check. This concern is tempered, as it is uncommon for applications to utilize empty associated data entries for authentication purposes. Consequently, the impact of this vulnerability is expected to be limited.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- OpenSSL
Affected Vendors
- The OpenSSL Project
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions