{"action":"Upgrade openssl to 3.0.8-1 or later.","affected":[{"fixed":"3.0.8-1","introduced":"0"}],"component":"openssl","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["3.0.8-1"],"id":"tcs_01M5NHSEHE1JWRJTT0GY9VKBDS","modified_at":"2026-10-26T18:01:14.406060322Z","published_at":"2023-02-08T20:15:24.323Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2023-0401","https://security-tracker.debian.org/tracker/CVE-2023-0401"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2023-0401#Debian:14/openssl","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2023-0401"}],"summary":"A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but"}