What’s Vulnerable › Vulnerabilities

CVE-2023-0216: Invalid pointer dereference in d2i_PKCS7 functions

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-08 · updated 2026-06-17
• Weakness: CWE-476

Description

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.

Affected products

• OpenSSL: from 3.0.0 through 3.0.7
• Stormshield Management Center: before 3.3.3 — fixed in 3.3.3

How to fix

Upgrade to a fixed version: Stormshield Management Center 3.3.3. Check the vendor advisory for mitigations.

References

• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
• https://security.gentoo.org/glsa/202402-08
• https://www.openssl.org/news/secadv/20230207.txt
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003
• https://security.gentoo.org/glsa/202402-08
• https://www.openssl.org/news/secadv/20230207.txt

Get alerted when CVE-2023-0216 or the next vulnerability affects your stack