# CVE-2023-2975: openssl: Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entrie... CVE-2023-2975 is fixed in 9 products on 1 platform, first by DEBIAN-CVE-2023-2975, released July 14, 2023. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2023-2975 - Priority: Routine - CVSS: 5.3 (medium) - EPSS: 0.0062 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jul 14, 2023 ## Description Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.12 | [libssl3 3.0.2-0ubuntu1.12](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.12.md) | Oct 23, 2023 | | Linux | openssl Debian 12.15 (bookworm) | 3.0.10-1~deb12u1 | [DEBIAN-CVE-2023-2975](https://patchblox.com/security/data/fix/linux/debian-cve-2023-2975.md) | Jul 14, 2023 | | Linux | openssl Debian 13.5 (trixie) | 3.0.10-1 | [DEBIAN-CVE-2023-2975](https://patchblox.com/security/data/fix/linux/debian-cve-2023-2975.md) | Jul 14, 2023 | | Linux | openssl Debian 14 | 3.0.10-1 | [DEBIAN-CVE-2023-2975](https://patchblox.com/security/data/fix/linux/debian-cve-2023-2975.md) | Jul 14, 2023 | | Linux | openssl RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.12 | [openssl 3.0.2-0ubuntu1.12](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.12.md) | Oct 23, 2023 | | Linux | openssl almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl amzn 2023 | 1:3.0.8-1.amzn2023.0.4 | [ALAS2023-2023-306](https://patchblox.com/security/data/fix/linux/alas2023-2023-306.md) | Aug 17, 2023 | | Linux | openssl ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | | Linux | openssl-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.4 | [ALAS2023-2023-306](https://patchblox.com/security/data/fix/linux/alas2023-2023-306.md) | Aug 17, 2023 | | Linux | openssl-debugsource amzn 2023 | 1:3.0.8-1.amzn2023.0.4 | [ALAS2023-2023-306](https://patchblox.com/security/data/fix/linux/alas2023-2023-306.md) | Aug 17, 2023 | | Linux | openssl-devel RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-devel almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-devel amzn 2023 | 1:3.0.8-1.amzn2023.0.4 | [ALAS2023-2023-306](https://patchblox.com/security/data/fix/linux/alas2023-2023-306.md) | Aug 17, 2023 | | Linux | openssl-devel ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | | Linux | openssl-fips-provider ol 9 | 0:3.0.7-2.0.1.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | | Linux | openssl-libs RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-libs almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-libs amzn 2023 | 1:3.0.8-1.amzn2023.0.4 | [ALAS2023-2023-306](https://patchblox.com/security/data/fix/linux/alas2023-2023-306.md) | Aug 17, 2023 | | Linux | openssl-libs ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.4 | [ALAS2023-2023-306](https://patchblox.com/security/data/fix/linux/alas2023-2023-306.md) | Aug 17, 2023 | | Linux | openssl-perl RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-perl almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-perl amzn 2023 | 1:3.0.8-1.amzn2023.0.4 | [ALAS2023-2023-306](https://patchblox.com/security/data/fix/linux/alas2023-2023-306.md) | Aug 17, 2023 | | Linux | openssl-perl ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | --- Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.