Wind River Support Network

Summary

Wind River Security Vulnerability Notice: CVE-2023-0286 of openssl

---

Affected Product Versions

Wind River Linux LTS 17, Wind River Linux 9, Wind River Linux 8, Wind River Linux Distro LTS 22, Wind River Linux LTS 22, Wind River Linux Distro LTS 21, Wind River Linux Distro CD, Wind River Linux LTS 21, Wind River Linux LTS 19, Wind River Linux LTS 18, Wind River Linux CD

---

Downloads

---

Description

New released openssl fixed a "High" severity issue. OpenSSL versions 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

CVE-2023-0286: X.400 address type confusion in X.509 GeneralName

What software is known to be affected by this CVE?

OpenSSL versions 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Is Wind River Linux affected by this CVE issue?

All WRLinux releases are affected by this issue.

Affected software components:

Mitigation

Wind River will continue to monitor the various Open Source projects and will incorporate fixes as appropriate to supported products.

Upstream mitigation as below:

Master: https://github.com/openssl/openssl/commit/7880536fe17c2b5450e279155bedd51771d28c9f

3.1: https://github.com/openssl/openssl/commit/84d85fcabd6d8f3740ad015bda329512630799df

3.0: https://github.com/openssl/openssl/commit/2f7530077e0ef79d98718138716bc51ca0cad658

1_1_1-stable: https://github.com/openssl/openssl/commit/2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9

---