CVE-2023-0286

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-c7-openssl-devel</name>
	<range><lt>1.0.2zg</lt></range>
      </package>
      <package>
	<name>openssl-unsafe</name>
	<range><lt>1.0.2zg</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>There is a type confusion vulnerability relating to X.400 address
	processing
inside an X.509 GeneralName. X.400 addresses were parsed as
	an ASN1_STRING but
the public structure definition for GENERAL_NAME
	incorrectly specified the type
of the x400Address field as ASN1_TYPE.
	This field is subsequently interpreted by
the OpenSSL function
	GENERAL_NAME_cmp as an ASN1_TYPE rather than an
ASN1_STRING.

When CRL
	checking is enabled (i.e. the application sets
	the
X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an
	attacker to pass
arbitrary pointers to a memcmp call, enabling them to
	read memory contents or
enact a denial of service. In most cases, the
	attack requires the attacker to
provide both the certificate chain and
	CRL, neither of which need to have a
valid signature. If the attacker
	only controls one of these inputs, the other
input must already
	contain an X.400 address as a CRL distribution point, which
is
	uncommon. As such, this vulnerability is most likely to only
	affect
applications which have implemented their own functionality for
	retrieving CRLs
over a network.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2023-0286</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2023-0286</url>
    </references>
    <dates>
      <discovery>2023-02-08</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>