CVE-2023-0217

NULL dereference validating DSA public key

An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.

We have discovered 16,092 live websites that are affected by CVE-2023-0217.

Test my site



Affected Software

Product  OpenSSL
Category Web Server Extensions
Vulnerable Domains16,092 live websites (2.40% of OpenSSL install base)
Vulnerable Versions
  • from 3 before 3.0.8
Vulnerable Versions Count7 versions ( 17.50% of all versions)



Details

  • Published - Feb 8, 2023
  • Updated - Feb 13, 2025

Credits

  • Kurt Roeckx (reporter)
  • Shane Lontis from Oracle (remediation developer)

CVE-2023-0217 usage by Country

United States3,623 websites


France2,345 websites
Germany1,486 websites
Japan1,317 websites
Canada848 websites
GB774 websites
Finland688 websites
Netherlands523 websites
Italy404 websites
Hungary397 websites

CVE-2023-0217 usage by TLD

.com5,684 websites
.org685 websites
.edu652 websites
.net643 websites
.ca638 websites
.fi534 websites
.jp534 websites
.fr489 websites
.de439 websites
.co.uk422 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2023-0217

Top websites that are affected by CVE-2023-0217. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.com United States*,***
***.edu United States**,***
******.org Singapore**,***
********.org France**,***
********.com United States**,***
*******.net Japan**,***
******.****.edu United States**,***
************************.com United States**,***
***.com United States**,***
******.com United States**,***
See full domain list

FAQ

A total of 16,092 websites have been identified as vulnerable to CVE-2023-0217, discovered through global website indexing conducted by WebTechSurvey.
OpenSSL is susceptible to CVE-2023-0217 vulnerability.
OpenSSL versions before 3.0.8 are vulnerable to CVE-2023-0217.
Version 3.0.8 of OpenSSL addresses the CVE-2023-0217 security vulnerability.