CVE-2024-4603

CVE-2024-4603 is a Denial of Service vulnerability affecting applications that use OpenSSL's EVP_PKEY_param_check() or EVP_PKEY_public_check() functions with untrusted DSA keys or parameters. These functions can experience significant delays when checking excessively long DSA keys, leading to a potential DoS. The vulnerability has a CVSS score of 5.3 (Medium), indicating a low attack complexity and impact limited to availability. While the OpenSSL SSL/TLS implementation is not affected, the OpenSSL 3.0 and 3.1 FIPS providers are vulnerable. There is currently no known active exploitation, public exploit code, or significant community discussion surrounding this CVE.