title: Invalid pointer dereference in d2i_PKCS7 functions
description: An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
The result of the dereference is an application crash which could
lead to a denial of service attack. The TLS implementation in OpenSSL
does not call this function however third party applications might
call these functions on untrusted data.
problem types: invalid pointer dereference
affected:
{
defaultStatus: unaffected
product: OpenSSL
vendor: OpenSSL
versions:
lessThan: 3.0.8, status: affected, version: 3.0.0, versionType: semver
}
metrics:
format: other
other: [
content: {'text': 'Moderate'}
type: https://www.openssl.org/policies/secpolicy.html
]