CVE-2023-6129
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Summary
CVE-2023-6129 is a vulnerability in the POLY1305 MAC implementation in OpenSSL for PowerPC CPUs. The issue arises due to a bug that restores vector register contents in an incorrect order upon return to the caller, potentially corrupting the application state. This corruption could result in incorrect calculations, crashes, or even complete control of the application process. The vulnerability is most relevant to CHACHA20-POLY1305 AEAD algorithm used in TLS protocol versions 1.2 and 1.3. Servers using OpenSSL and this specific cipher are at risk if a malicious client can influence its use. However, no known applications have been identified as being affected. Thus, the severity of this issue is considered low.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- OpenSSL
- Openssl Project Openssl
Affected Vendors
- The OpenSSL Project
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions