CVE-2023-2975

Summary

CVE-2023-2975 is a low severity vulnerability affecting the OpenSSL implementation of the AES-SIV cipher. The issue arises when the algorithm ignores empty, unauthenticated associated data entries during the authentication process. Applications that use AES-SIV to authenticate empty data entries as associated data may be susceptible to data manipulation, as the OpenSSL implementation will not perform the expected authentication check. This concern is tempered, as it is uncommon for applications to utilize empty associated data entries for authentication purposes. Consequently, the impact of this vulnerability is expected to be limited.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.