# CVE-2023-6237: libssl3t64: Issue summary: Checking excessively long invalid RSA public keys may takea long time.Impact summary: Applications tha... CVE-2023-6237 is fixed in 27 products on 1 platform, first by libssl3t64 3.0.10-1ubuntu4, released January 15, 2024. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2023-6237 - Priority: Routine - CVSS: 5.9 (Low) - EPSS: 0.0230 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jan 14, 2024 ## Description Issue summary: Checking excessively long invalid RSA public keys may takea long time.Impact summary: Applications that use the function EVP_PKEY_public_check()to check RSA public keys may experience long delays. Where the key thatis being checked has been obtained from an untrusted source this may leadto a Denial of Service.When function EVP_PKEY_public_check() is called on RSA public keys,a computation is done to confirm that the RSA modulus, n, is composite.For valid RSA keys, n is a product of two or more large primes and thiscomputation completes quickly. However, if n is an overly large prime,then this computation would take a long time.An application that calls EVP_PKEY_public_check() and supplies an RSA keyobtained from an untrusted source could be vulnerable to a Denial ofServiceattack.The function EVP_PKEY_public_check() is not called from other OpenSSLfunctions however it is called from the OpenSSL pkey command lineapplication. For that reason that application is also vulnerable if usedwith the '-pubin' and '-check' options on untrusted data.The OpenSSL SSL/TLS implementation is not affected by this issue.The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | edk2 rocky 9 | 0:20240524-6.el9_5.3 | [RLSA-2024:9088](https://patchblox.com/security/data/fix/linux/rlsa-2024-9088.md) | Mar 17, 2025 | | Linux | edk2-aarch64 RHEL 9 | 0:20240524-6.el9_5 | [RHSA-2024:9088](https://patchblox.com/security/data/fix/linux/rhsa-2024-9088.md) | Nov 12, 2024 | | Linux | edk2-aarch64 almalinux 9 | 20240524-6.el9_5 | [ALSA-2024:9088](https://patchblox.com/security/data/fix/linux/alsa-2024-9088.md) | Nov 12, 2024 | | Linux | edk2-aarch64 ol 9 | 0:20240524-6.0.1.el9_5 | [ELSA-2024-9088](https://patchblox.com/security/data/fix/linux/elsa-2024-9088.md) | Nov 14, 2024 | | Linux | edk2-ovmf RHEL 9 | 0:20240524-6.el9_5 | [RHSA-2024:9088](https://patchblox.com/security/data/fix/linux/rhsa-2024-9088.md) | Nov 12, 2024 | | Linux | edk2-ovmf almalinux 9 | 20240524-6.el9_5 | [ALSA-2024:9088](https://patchblox.com/security/data/fix/linux/alsa-2024-9088.md) | Nov 12, 2024 | | Linux | edk2-ovmf ol 9 | 0:20240524-6.0.1.el9_5 | [ELSA-2024-9088](https://patchblox.com/security/data/fix/linux/elsa-2024-9088.md) | Nov 14, 2024 | | Linux | edk2-tools RHEL 9 | 0:20240524-6.el9_5 | [RHSA-2024:9088](https://patchblox.com/security/data/fix/linux/rhsa-2024-9088.md) | Nov 12, 2024 | | Linux | edk2-tools almalinux 9 | 20240524-6.el9_5 | [ALSA-2024:9088](https://patchblox.com/security/data/fix/linux/alsa-2024-9088.md) | Nov 12, 2024 | | Linux | edk2-tools ol 9 | 0:20240524-6.0.1.el9_5 | [ELSA-2024-9088](https://patchblox.com/security/data/fix/linux/elsa-2024-9088.md) | Nov 14, 2024 | | Linux | edk2-tools-doc RHEL 9 | 0:20240524-6.el9_5 | [RHSA-2024:9088](https://patchblox.com/security/data/fix/linux/rhsa-2024-9088.md) | Nov 12, 2024 | | Linux | edk2-tools-doc almalinux 9 | 20240524-6.el9_5 | [ALSA-2024:9088](https://patchblox.com/security/data/fix/linux/alsa-2024-9088.md) | Nov 12, 2024 | | Linux | edk2-tools-doc ol 9 | 0:20240524-6.0.1.el9_5 | [ELSA-2024-9088](https://patchblox.com/security/data/fix/linux/elsa-2024-9088.md) | Nov 14, 2024 | | Linux | efi-shell-aa64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-aa64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-aa64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | | Linux | efi-shell-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-arm 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-arm-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | | Linux | efi-shell-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-ia32 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-ia32-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | | Linux | efi-shell-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-riscv64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-riscv64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | | Linux | efi-shell-x64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-x64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-x64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | | Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.14 | [libssl3 3.0.2-0ubuntu1.14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.14.md) | Jan 26, 2024 | | Linux | libssl3 Ubuntu 24.04.5 LTS (noble) | 3.0.10-1ubuntu4 | [libssl3 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssl3-3.0.10-1ubuntu4.md) | Jan 26, 2024 | | Linux | libssl3t64 Ubuntu 24.10 (oracular) | 3.0.10-1ubuntu4 | [libssl3t64 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libssl3t64-3.0.10-1ubuntu4.md) | Jan 15, 2024 | | Linux | libssl3t64 Ubuntu 25.04 (plucky) | 3.0.10-1ubuntu4 | [libssl3t64 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libssl3t64-3.0.10-1ubuntu4.md) | Jan 15, 2024 | | Linux | openssl Debian 12.15 (bookworm) | 3.0.13-1~deb12u1 | [DEBIAN-CVE-2023-6237](https://patchblox.com/security/data/fix/linux/debian-cve-2023-6237.md) | Apr 25, 2024 | | Linux | openssl Debian 13.5 (trixie) | 3.1.5-1 | [DEBIAN-CVE-2023-6237](https://patchblox.com/security/data/fix/linux/debian-cve-2023-6237.md) | Apr 25, 2024 | | Linux | openssl Debian 14 | 3.1.5-1 | [DEBIAN-CVE-2023-6237](https://patchblox.com/security/data/fix/linux/debian-cve-2023-6237.md) | Apr 25, 2024 | | Linux | openssl RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.14 | [openssl 3.0.2-0ubuntu1.14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.14.md) | Jan 26, 2024 | | Linux | openssl Ubuntu 24.04.5 LTS (noble) | 3.0.10-1ubuntu4 | [openssl 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-openssl-3.0.10-1ubuntu4.md) | Jan 26, 2024 | | Linux | openssl Ubuntu 24.10 (oracular) | 3.0.10-1ubuntu4 | [openssl 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-openssl-3.0.10-1ubuntu4.md) | Jan 15, 2024 | | Linux | openssl Ubuntu 25.04 (plucky) | 3.0.10-1ubuntu4 | [openssl 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-openssl-3.0.10-1ubuntu4.md) | Jan 15, 2024 | | Linux | openssl almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 | | Linux | openssl ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | | Linux | openssl-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 | | Linux | openssl-debugsource amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 | | Linux | openssl-devel RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-devel almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-devel amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 | | Linux | openssl-devel ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | | Linux | openssl-fips-provider ol 9 | 0:3.0.7-2.0.1.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | | Linux | openssl-libs RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-libs almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-libs amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 | | Linux | openssl-libs ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 | | Linux | openssl-perl RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-perl almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 | | Linux | openssl-perl amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 | | Linux | openssl-perl ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 | | Linux | openssl-snapsafe-libs amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 | | Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 | | Linux | ovmf Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [ovmf 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | | Linux | ovmf-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [ovmf-ia32 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-ia32-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | | Linux | qemu-efi-aarch64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [qemu-efi-aarch64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-aarch64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | | Linux | qemu-efi-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [qemu-efi-arm 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-arm-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | | Linux | qemu-efi-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [qemu-efi-riscv64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-riscv64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.