# CVE-2023-5363: libssl3t64: Issue summary: A bug has been identified in the processing of key andinitialisation vector (IV) lengths CVE-2023-5363 is fixed in 11 products on 1 platform, first by libssl3 3.0.2-0ubuntu1.12, released October 23, 2023. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2023-5363 - Priority: High - CVSS: 7.5 (Medium) - EPSS: 0.0394 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 23, 2023 ## Description Issue summary: A bug has been identified in the processing of key andinitialisation vector (IV) lengths. This can lead to potential truncationor overruns during the initialisation of some symmetric ciphers.Impact summary: A truncation in the IV can result in non-uniqueness,which could result in loss of confidentiality for some cipher modes.When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() orEVP_CipherInit_ex2() the provided OSSL_PARAM array is processed afterthe key and IV have been established. Any alterations to the key length,via the "keylen" parameter or the IV length, via the "ivlen" parameter,within the OSSL_PARAM array will not take effect as intended, potentiallycausing truncation or overreading of these values. The following ciphersand cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.For the CCM, GCM and OCB cipher modes, truncation of the IV can result inloss of confidentiality. For example, when following NIST's SP 800-38Dsection 8.2.1 guidance for constructing a deterministic IV for AES inGCM mode, truncation of the counter portion could lead to IV reuse.Both truncations and overruns of the key and overruns of the IV willproduce incorrect results and could, in some cases, trigger a memoryexception. However, these issues are not currently assessed as securitycritical.Changing the key and/or IV lengths is not considered to be a commonoperationand the vulnerable API was recently introduced. Furthermore it is likelythatapplication developers will have spotted this problem during testing sincedecryption would fail unless both peers in the communication were similarlyvulnerable. For these reasons we expect the probability of an applicationbeingvulnerable to this to be quite low. However if an application is vulnerablethenthis issue is considered very serious. For these reasons we have assessedthisissue as Moderate severity overall.The OpenSSL SSL/TLS implementation is not affected by this issue.The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this becausethe issue lies outside of the FIPS provider boundary.OpenSSL 3.1 and 3.0 are vulnerable to this issue. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.12 | [libssl3 3.0.2-0ubuntu1.12](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.12.md) | Oct 23, 2023 | | Linux | libssl3 Ubuntu 24.04.5 LTS (noble) | 3.0.10-1ubuntu2.1 | [libssl3 3.0.10-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssl3-3.0.10-1ubuntu2.1.md) | Oct 23, 2023 | | Linux | libssl3t64 Ubuntu 24.10 (oracular) | 3.0.10-1ubuntu2.1 | [libssl3t64 3.0.10-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libssl3t64-3.0.10-1ubuntu2.1.md) | Oct 24, 2023 | | Linux | libssl3t64 Ubuntu 25.04 (plucky) | 3.0.10-1ubuntu2.1 | [libssl3t64 3.0.10-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libssl3t64-3.0.10-1ubuntu2.1.md) | Oct 24, 2023 | | Linux | openssl Debian 12.15 (bookworm) | 3.0.11-1~deb12u2 | [DSA-5532-1](https://patchblox.com/security/data/fix/linux/dsa-5532-1.md) | Oct 24, 2023 | | Linux | openssl Debian 13.5 (trixie) | 3.0.12-1 | [DEBIAN-CVE-2023-5363](https://patchblox.com/security/data/fix/linux/debian-cve-2023-5363.md) | Oct 25, 2023 | | Linux | openssl Debian 14 | 3.0.12-1 | [DEBIAN-CVE-2023-5363](https://patchblox.com/security/data/fix/linux/debian-cve-2023-5363.md) | Oct 25, 2023 | | Linux | openssl RHEL 9 | 1:3.0.7-25.el9_3 | [RHSA-2024:0310](https://patchblox.com/security/data/fix/linux/rhsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.12 | [openssl 3.0.2-0ubuntu1.12](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.12.md) | Oct 23, 2023 | | Linux | openssl Ubuntu 24.04.5 LTS (noble) | 3.0.10-1ubuntu2.1 | [openssl 3.0.10-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-openssl-3.0.10-1ubuntu2.1.md) | Oct 23, 2023 | | Linux | openssl Ubuntu 24.10 (oracular) | 3.0.10-1ubuntu2.1 | [openssl 3.0.10-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-openssl-3.0.10-1ubuntu2.1.md) | Oct 24, 2023 | | Linux | openssl Ubuntu 25.04 (plucky) | 3.0.10-1ubuntu2.1 | [openssl 3.0.10-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-openssl-3.0.10-1ubuntu2.1.md) | Oct 24, 2023 | | Linux | openssl almalinux 9 | 1:3.0.7-25.el9_3 | [ALSA-2024:0310](https://patchblox.com/security/data/fix/linux/alsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl amzn 2023 | 1:3.0.8-1.amzn2023.0.9 | [ALAS2023-2023-406](https://patchblox.com/security/data/fix/linux/alas2023-2023-406.md) | Oct 30, 2023 | | Linux | openssl ol 9 | 1:3.0.7-25.0.1.el9_3 | [ELSA-2024-0310](https://patchblox.com/security/data/fix/linux/elsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.9 | [ALAS2023-2023-406](https://patchblox.com/security/data/fix/linux/alas2023-2023-406.md) | Oct 30, 2023 | | Linux | openssl-debugsource amzn 2023 | 1:3.0.8-1.amzn2023.0.9 | [ALAS2023-2023-406](https://patchblox.com/security/data/fix/linux/alas2023-2023-406.md) | Oct 30, 2023 | | Linux | openssl-devel RHEL 9 | 1:3.0.7-25.el9_3 | [RHSA-2024:0310](https://patchblox.com/security/data/fix/linux/rhsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-devel almalinux 9 | 1:3.0.7-25.el9_3 | [ALSA-2024:0310](https://patchblox.com/security/data/fix/linux/alsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-devel amzn 2023 | 1:3.0.8-1.amzn2023.0.9 | [ALAS2023-2023-406](https://patchblox.com/security/data/fix/linux/alas2023-2023-406.md) | Oct 30, 2023 | | Linux | openssl-devel ol 9 | 1:3.0.7-25.0.1.el9_3 | [ELSA-2024-0310](https://patchblox.com/security/data/fix/linux/elsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-libs RHEL 9 | 1:3.0.7-25.el9_3 | [RHSA-2024:0310](https://patchblox.com/security/data/fix/linux/rhsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-libs almalinux 9 | 1:3.0.7-25.el9_3 | [ALSA-2024:0310](https://patchblox.com/security/data/fix/linux/alsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-libs amzn 2023 | 1:3.0.8-1.amzn2023.0.9 | [ALAS2023-2023-406](https://patchblox.com/security/data/fix/linux/alas2023-2023-406.md) | Oct 30, 2023 | | Linux | openssl-libs ol 9 | 1:3.0.7-25.0.1.el9_3 | [ELSA-2024-0310](https://patchblox.com/security/data/fix/linux/elsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.9 | [ALAS2023-2023-406](https://patchblox.com/security/data/fix/linux/alas2023-2023-406.md) | Oct 30, 2023 | | Linux | openssl-perl RHEL 9 | 1:3.0.7-25.el9_3 | [RHSA-2024:0310](https://patchblox.com/security/data/fix/linux/rhsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-perl almalinux 9 | 1:3.0.7-25.el9_3 | [ALSA-2024:0310](https://patchblox.com/security/data/fix/linux/alsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-perl amzn 2023 | 1:3.0.8-1.amzn2023.0.9 | [ALAS2023-2023-406](https://patchblox.com/security/data/fix/linux/alas2023-2023-406.md) | Oct 30, 2023 | | Linux | openssl-perl ol 9 | 1:3.0.7-25.0.1.el9_3 | [ELSA-2024-0310](https://patchblox.com/security/data/fix/linux/elsa-2024-0310.md) | Jan 22, 2024 | | Linux | openssl-snapsafe-libs amzn 2023 | 1:3.0.8-1.amzn2023.0.9 | [ALAS2023-2023-406](https://patchblox.com/security/data/fix/linux/alas2023-2023-406.md) | Oct 30, 2023 | | Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.9 | [ALAS2023-2023-406](https://patchblox.com/security/data/fix/linux/alas2023-2023-406.md) | Oct 30, 2023 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.