---
schema_version: '1.0'
id: security-20260705-642de7
url: https://osv.dev/vulnerability/DEBIAN-CVE-2023-6237
url_hash: 642de728420482bb7f0cba7de918fa48e2c26037c419a10adf276d7fc65caaef
canonical_url: https://osv.dev/vulnerability/DEBIAN-CVE-2023-6237
source: osv:debian
category: security/os
category_raw: cve/os
region: null
tags:
- cve
- DEBIAN-CVE-2023-6237
- severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- openssl
- Debian
lang: en
published_at: '2024-04-25T07:15:45Z'
fetched_at: '2026-07-05T15:34:33Z'
updated_at: '2026-07-05T15:35:24Z'
status: published
content_hash: 1a7ed4ac845494ea7b6dcf198dc486d2c866cc08ae08016643a9986d4374ab75
license_note: full
summary: 'Issue summary: Checking excessively long invalid RSA public keys may take
  a long time.  Impact summary: Applications that use the function EVP_PKEY_public_check()
  to check RSA public keys may experience long delays. Where the key that is being
  checked has been obtained from an un'
summary_source: rss
summary_en: 'Issue summary: Checking excessively long invalid RSA public keys may
  take a long time.  Impact summary: Applications that use the function EVP_PKEY_public_check()
  to check RSA public keys may experience long delays. Where the key that is being
  checked has been obtained from an un'
entities: []
key_facts: []
related: []
related_auto: []
title: DEBIAN-CVE-2023-6237 — openssl
---

# DEBIAN-CVE-2023-6237 — openssl

## TL;DR
Issue summary: Checking excessively long invalid RSA public keys may take a long time.  Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an un

## Key Points
- cve / DEBIAN-CVE-2023-6237 / severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H / openssl / Debian

## Details
**Severity:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** DEBIAN-CVE-2023-6237

**Affected (your watchlist):**
- `Debian:openssl` 3.0.11-1~deb12u2 → no fixed version listed [rpi]

**Details:**
Issue summary: Checking excessively long invalid RSA public keys may take a long time.  Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service.  When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time.  An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack.  The function EVP_PKEY_public_check() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the '-pubin' and '-check' options on untrusted data.  The OpenSSL SSL/TLS implementation is not affected by this issue.  The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

**References:**
- https://security-tracker.debian.org/tracker/CVE-2023-6237

_Data: OSV.dev (upstream: debian) — https://osv.dev/vulnerability/DEBIAN-CVE-2023-6237_

## Source
元記事: [DEBIAN-CVE-2023-6237 — openssl](https://osv.dev/vulnerability/DEBIAN-CVE-2023-6237) — published 2024-04-25T07:15:45Z