CVE catalog

CVE-2023-0401

openssl: CVE-2023-0401

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Feb 7, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.85% · Oct 25, 2026

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openssl	sid	`3.6.5-1`	fixed
Debian	openssl	forky	`3.6.5-1`	fixed
Debian	openssl	trixie	`3.5.7-1~deb13u2`	fixed
Debian	openssl	trixie-security	`3.5.7-1~deb13u3`	fixed
Debian	openssl	bookworm	`3.0.20-1~deb12u2`	fixed
Debian	openssl	bookworm-security	`3.0.22-1~deb12u2`	fixed
Alpine	openssl	3.17	`3.0.8-r0`	fixed
Alpine	openssl	3.18	`3.0.8-r0`	fixed
Alpine	openssl	3.19	`3.0.8-r0`	fixed
Alpine	openssl	3.20	`3.0.8-r0`	fixed
Alpine	openssl	3.21	`3.0.8-r0`	fixed
Alpine	openssl	3.22	`3.0.8-r0`	fixed
Alpine	openssl	3.23	`3.0.8-r0`	fixed
Alpine	openssl	3.24	`3.0.8-r0`	fixed
Alpine	openssl3	3.15	`3.0.8-r0`	fixed
Alpine	openssl3	3.16	`3.0.8-r0`	fixed
Ubuntu	nodejs	22.04	`12.22.5~dfsg-5ubuntu1`	vulnerable
Ubuntu	nodejs	22.04	`12.22.7~dfsg-2ubuntu1`	vulnerable
Ubuntu	nodejs	22.04	`12.22.7~dfsg-2ubuntu3`	vulnerable
Ubuntu	nodejs	22.04	`12.22.9~dfsg-1ubuntu2`	vulnerable
Ubuntu	nodejs	22.04	`12.22.9~dfsg-1ubuntu3`	vulnerable
Ubuntu	nodejs	22.04	`12.22.9~dfsg-1ubuntu3.1`	vulnerable
Ubuntu	nodejs	22.04	`12.22.9~dfsg-1ubuntu3.2`	vulnerable
Ubuntu	nodejs	22.04	`12.22.9~dfsg-1ubuntu3.3`	fixed
Ubuntu	openssl	22.04	`1.1.1l-1ubuntu1`	vulnerable
Ubuntu	openssl	22.04	`3.0.0-1ubuntu1`	vulnerable
Ubuntu	openssl	22.04	`3.0.1-0ubuntu1`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.1`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.2`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.4`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.5`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.6`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.7`	vulnerable
Ubuntu	openssl	22.04	`3.0.2-0ubuntu1.8`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openssl	source	sid	`3.0.8-1`	not yet assigned	Not reported	Not reported
Debian	openssl	source	forky	`3.0.8-1`	not yet assigned	Not reported	Not reported
Debian	openssl	source	trixie	`3.0.8-1`	not yet assigned	Not reported	Not reported
Debian	openssl	source	bookworm	`3.0.8-1`	not yet assigned	Not reported	Not reported
Alpine	openssl	apk	3.17	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Alpine	openssl	apk	3.18	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Alpine	openssl	apk	3.19	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Alpine	openssl	apk	3.20	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Alpine	openssl	apk	3.21	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Alpine	openssl	apk	3.22	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Alpine	openssl	apk	3.23	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Alpine	openssl	apk	3.24	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Alpine	openssl3	apk	3.15	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Alpine	openssl3	apk	3.16	`3.0.8-r0`	Not reported	ALPINE-CVE-2023-0401	Not reported
Ubuntu	nodejs	deb	22.04	`12.22.9~dfsg-1ubuntu3.3`	Not reported	UBUNTU-CVE-2023-0401	Not reported
Ubuntu	openssl	deb	22.04	`3.0.2-0ubuntu1.8`	Not reported	UBUNTU-CVE-2023-0401	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libssl3]Unknown
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
[libssl-dev]Unknown
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
[libssl-doc]Unknown
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · all · bookworm
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · all · bookworm-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
[openssl]Unknown
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

[Debian 13 (Trixie)]

[libssl3t64]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
[libssl-dev]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
[libssl-doc]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · all · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u3 · all · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
[openssl]Unknown
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
[openssl-provider-fips]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
[openssl-provider-legacy]Unknown
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.0.8-1
  dsa · openssl · debian · 13

Observed: Oct 23, 2026, 7:24:11 PM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]