VYPR
← All advisories
High severityNVD Advisory· Published Feb 8, 2023· Updated Nov 4, 2025

NULL dereference validating DSA public key

CVE-2023-0217

Description

An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack.

The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A malformed DSA public key can cause an invalid pointer dereference in OpenSSL's EVP_PKEY_public_check(), leading to denial of service.

Vulnerability

Overview

CVE-2023-0217 is a denial-of-service vulnerability in OpenSSL caused by an invalid pointer dereference on read when the EVP_PKEY_public_check() function processes a malformed DSA public key [2]. The root cause is that the function does not properly validate the key structure before dereferencing a pointer, leading to a crash [1][2].

Attack

Vector

The vulnerability can be triggered by an attacker supplying a crafted DSA public key to an application that calls EVP_PKEY_public_check() on untrusted keys [2]. While the TLS implementation in OpenSSL does not invoke this function, applications may do so to meet additional security requirements such as FIPS 140-3 [1][2]. No authentication is required, and the attack can be performed remotely if the application accepts public keys from external sources.

Impact

Successful exploitation results in an application crash, causing a denial of service [2]. The impact is limited to availability; there is no evidence of code execution or privilege escalation.

Mitigation

OpenSSL has released patches in versions 3.0.8, 1.1.1t, and 1.0.2zg (for premium support customers) [1][3]. Users are advised to upgrade to these or later versions. The Gentoo security advisory also recommends upgrading to OpenSSL 3.0.10 or later [4]. No workaround is available [4].

References
  1. https://www.openssl.org/news/secadv/20230207.txt
  2. NVD - CVE-2023-0217
  3. `NULL` dereference validating DSA public key › RustSec Advisory Database
  4. Multiple Vulnerabilities (GLSA 202402-08) — Gentoo security

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openssl-srccrates.io
>= 300.0.0, < 300.0.12300.0.12

Affected products

43

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.