CVE-2023-5363: Incorrect cipher key & IV length processing
Published Oct 13, 2023
·Updated
Incorrect cipher key & IV length processing
Affected Software
24 affected componentsFixes available
IBM Cognos Analytics<=12.0.0-12.0.2
IBM Cognos Analytics<=11.2.0-11.2.4 FP3
OpenSSL OpenSSL>=3.0.0<3.0.12
OpenSSL OpenSSL>=3.1.0<3.1.4
Debian Debian Linux=12.0
All of the following
NetApp H300s Firmware
NetApp H300s
All of the following
NetApp H410s Firmware
NetApp H410s
All of the following
NetApp H500s Firmware
NetApp H500s
All of the following
NetApp H700s Firmware
NetApp H700s
All of the following
NetApp H410c Firmware
NetApp H410c
debian/openssl
1.1.1w-0+deb11u11.1.1w-0+deb11u23.0.15-1~deb12u13.0.14-1~deb12u23.5.0-1
redhat/OpenSSL<3.0.12
3.0.12
redhat/OpenSSL<3.1.4
3.1.4
Microsoft azl3 cloud-hypervisor-cvm 38.0.72-2
Microsoft cbl2 hvloader 1.0.1-5
Microsoft cbl2 hvloader 1.0.1-5
Microsoft cbl2 cloud-hypervisor-cvm 38.0.72.2-1
Microsoft cbl2 cloud-hypervisor-cvm 38.0.72-1
Microsoft azl3 cloud-hypervisor-cvm 38.0.72.2-1
Remediation
Event History
Oct 13, 2023
Data Sourced
via Red Hat·12:44 PM
DescriptionSeverityAffected Software
Oct 24, 2023
CVE Published
via MITRE·03:31 PM
Data Sourced
via MITRE·03:31 PM
DescriptionWeakness
Oct 25, 2023
Data Sourced
via NVD·06:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 31, 2023
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
SeverityAffected Software
Updated
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Feb 17, 2024
Data Sourced
via Launchpad·12:50 AM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·02:44 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this bug?
The vulnerability ID of this bug is CVE-2023-5363.
2
What is the title of this vulnerability?
The title of this vulnerability is 'Incorrect cipher key & IV length processing'.
3
What is the description of this vulnerability?
A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers.
4
Which software is affected by this vulnerability?
The OpenSSL package is affected by this vulnerability.
5
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following references: [CVE-2023-5363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5363), [OpenSSL Security Advisory](https://www.openssl.org/news/secadv/20231024.txt), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-5363).