CVE-2023-0216 (published 2023-02-08T19:03:05.652Z)
An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.

The result of the dereference is an application crash which could
lead to a denial of service attack. The TLS implementation in OpenSSL
does not call this function however third party applications might
call these functions on untrusted data.


Affected products: Vendor: OpenSSL
Product: OpenSSL
Versions: 3.0.0