OpenSSL 1.1.1 < 1.1.1x Multiple Vulnerabilities

CVE-2023-5678 (CVSS 5.3) causes excessive CPU consumption when OpenSSL processes crafted X9.42 DH parameters via DH_generate_key() or DH_check_pub_key(). CVE-2024-0727 (CVSS 5.5) triggers a NULL pointer dereference crash when parsing a maliciously formatted PKCS12 file through PKCS12_parse() and related APIs. Both are denial-of-service only — no confidentiality or integrity impact. Affected: OpenSSL 1.1.1 through 1.1.1w. Fixed in 1.1.1x (premium extended support release). Note that OpenSSL 1.1.1 reached community EOL in September 2023; 1.1.1x is only available to paid extended-support customers via vendors like SafeLogic or HeroDevs.

The vendor MEDIUM rating is accurate and, if anything, slightly generous. Both CVEs require either local access or user interaction — an attacker must convince a victim process to load a crafted PKCS12 file or DH parameter set. The impact ceiling is application crash or CPU stall; there is no path to code execution, privilege escalation, or data exfiltration. Tenable's own VPR score of 3.0 (23rd percentile) confirms these sit at the low end of MEDIUM. The main complicating factor is that OpenSSL 1.1.1 is EOL: no more community patches are coming, so the real risk is the *next* vuln in this branch, not these two specifically.

Why this verdict

• DoS-only impact ceiling: Both CVEs affect availability only — CVSS vectors confirm C:N/I:N across both. No path to code execution, privilege escalation, or data exfiltration exists.
• Local access / user interaction required: CVE-2024-0727 requires UI:R (victim must open a malicious PKCS12 file). CVE-2023-5678 is network-reachable in theory (AV:N) but only via DH parameter negotiation, which modern TLS stacks handle with pre-configured parameters, not attacker-supplied ones.
• No exploitation evidence: Neither CVE is KEV-listed, no in-the-wild campaigns documented, no weaponized PoC published. Tenable's own VPR of 3.0 confirms low real-world risk.
• Role multiplier: OpenSSL is embedded in high-value components (network edge appliances, web servers, VPN gateways, identity providers). However, even on these roles, the attack chain requires the application to parse *attacker-controlled* PKCS12 or DH parameter files — a scenario that does not apply to standard TLS termination or certificate-based auth. On a domain controller or load balancer, the DH params and certs are admin-provisioned. The blast radius is process-level crash (host-scoped, transient), not domain/fleet compromise. The floor remains MEDIUM because no high-value role produces an outcome worse than transient DoS.
• EOL branch context: OpenSSL 1.1.1 is EOL. While these specific CVEs are low-impact, the EOL status means future higher-severity vulns will go unpatched. This is a migration signal, not a severity upgrade for *these* CVEs.

Why not higher?

Upgrading to HIGH would require either a code-execution path, active exploitation, or a fleet-scale blast radius. None exist here. The impact is strictly availability, the attack requires local access or user interaction, and the worst case on any deployment role is a single-process crash that auto-restarts. The Tenable VPR of 3.0 independently confirms this sits at the low end of MEDIUM.

Why not lower?

Dropping to LOW would undercount the ubiquity of OpenSSL and the EOL status of 1.1.1. CVE-2023-5678 has a network-adjacent attack vector in specific configurations, and OpenSSL powers critical services where even transient DoS matters. The CVSS base scores of 5.3–5.5 are appropriate anchors for MEDIUM.

1. Migrate off OpenSSL 1.1.1 to 3.0.x or 3.1.x+ — The 1.1.1 branch is community EOL. These CVEs are low-severity, but the *next* one may not be. Plan migration within the noisgate 365-day remediation window for MEDIUM findings. This is the only durable fix.
2. Audit applications that accept untrusted PKCS12 files — Identify any service that calls PKCS12_parse() on user-supplied input. Add input validation or sandboxing. Most enterprise TLS deployments do NOT accept external PKCS12 uploads, so your exposure may be zero.
3. Ensure process supervisors auto-restart affected services — Configure systemd Restart=always, Kubernetes liveness probes, or equivalent watchdogs on OpenSSL-linked services. This caps the DoS window to seconds rather than indefinite outage.
4. Pin DH parameters to known-good values — Avoid accepting externally negotiated DH parameters. Use pre-generated dhparam files (2048-bit minimum) and configure TLS libraries to reject oversized parameters. This neutralizes CVE-2023-5678.

Run this on each target host where OpenSSL is installed. Execute as any user with read access to the openssl binary: bash check_openssl_184811.sh. No root privileges required.

#!/usr/bin/env bash
# check_openssl_184811.sh
# Checks whether the installed OpenSSL is vulnerable to CVE-2023-5678 / CVE-2024-0727
# (Tenable plugin 184811: OpenSSL 1.1.1 < 1.1.1x)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

OPENSSL_BIN="${1:-openssl}"

if ! command -v "$OPENSSL_BIN" &>/dev/null; then
  echo "UNKNOWN - openssl binary not found at '$OPENSSL_BIN'"
  exit 2
fi

VERSION_STR=$("$OPENSSL_BIN" version 2>/dev/null)
echo "Detected: $VERSION_STR"

# Extract version components
if [[ "$VERSION_STR" =~ OpenSSL\ 1\.1\.1([a-z]*)\ ]]; then
  PATCH_LETTER="${BASH_REMATCH[1]}"
  if [[ -z "$PATCH_LETTER" ]]; then
    # OpenSSL 1.1.1 (no letter) - vulnerable
    echo "VULNERABLE - OpenSSL 1.1.1 (no patch letter) is below 1.1.1x"
    exit 1
  fi
  # Compare: 'x' is the fix. Letters a-w are vulnerable.
  if [[ "$PATCH_LETTER" < "x" ]]; then
    echo "VULNERABLE - OpenSSL 1.1.1${PATCH_LETTER} is below 1.1.1x"
    exit 1
  else
    echo "PATCHED - OpenSSL 1.1.1${PATCH_LETTER} is at or above 1.1.1x"
    exit 0
  fi
elif [[ "$VERSION_STR" =~ OpenSSL\ 3\. ]]; then
  echo "PATCHED - OpenSSL 3.x branch detected (not affected by this plugin)"
  exit 0
elif [[ "$VERSION_STR" =~ OpenSSL\ 1\.0\. ]]; then
  echo "VULNERABLE - OpenSSL 1.0.x is EOL and likely affected (check CVE-2024-0727 separately)"
  exit 1
else
  echo "UNKNOWN - Could not parse version from: $VERSION_STR"
  exit 2
fi

Sources

1. Tenable Plugin 184811
2. NVD — CVE-2024-0727
3. CyberStrike — CVE-2024-0727 Detail
4. SentinelOne — CVE-2023-5678
5. OpenSSL 1.1.1 Release Notes
6. OpenSSL Vulnerabilities Page
7. OpenSSL End-of-Life Dates
8. SafeLogic Extended Support for OpenSSL