{"id":"CVE-2023-35784","details":"A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.","modified":"2026-08-27T08:55:12.905022Z","published":"2023-06-16T00:00:00Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"7.2"},{"introduced":"7.3"}],"source":"DESCRIPTION"}],"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35784.json"},"references":[{"type":"WEB","url":"https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt"},{"type":"WEB","url":"https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt"},{"type":"WEB","url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig"},{"type":"WEB","url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35784.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35784"},{"type":"FIX","url":"https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libressl/openbsd","events":[{"introduced":"0"},{"introduced":"259e36b1c57849c281afb8526bab11e7ba2592e2"},{"fixed":"242532e946dd73e728b67bfe0915634d91462442"},{"fixed":"ec44842c68b88bb1c93a8d517ef859e8a456a822"},{"fixed":"e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.6.3"},{"introduced":"3.7.x"},{"fixed":"3.7.3"}],"source":["DESCRIPTION","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/libressl/portable","events":[{"introduced":"0"},{"fixed":"4f1a1ffccf22a49d8c307f5a91b368e048278f55"},{"introduced":"5a590f8e0c1bb3b3bf7ba02ee7d3ac0c1e09a1ae"},{"fixed":"5b6fbf7eb549a97e4852dbca1cd6cc0dcf64c2ef"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:openbsd:libressl:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.6.3"},{"introduced":"3.7.0"},{"fixed":"3.7.3"}]}}],"versions":["libressl-v3.7.2","libressl-v3.7.1","libressl-v3.6.2","libressl-v3.6.1","libressl-v3.7.0","libressl-v3.6.0","libressl-v3.5.1","libressl-v3.5.0","libressl-v3.4.0","libressl-v3.3.1","libressl-v3.3.0","libressl-v3.2.1","libressl-v3.2.0","libressl-v3.1.0","libressl-v3.0.1","libressl-v3.0.0","libressl-v2.9.0","libressl-v2.8.1","libressl-v2.8.0","libressl-v2.7.1","libressl-v2.7.0","libressl-v2.6.2","libressl-v2.6.1","libressl-v2.6.0","libressl-v2.5.2","libressl-v2.5.1","libressl-v2.5.0","libressl-v2.4.1","libressl-v2.4.0","libressl-v2.3.2","libressl-v2.3.1","libressl-v2.3.0","libressl-v2.2.1","libressl-v2.2.0","libressl-v2.1.4","libressl-v2.1.3","libressl-v2.1.2","v3.7.2","v3.6.2","v3.7.1","v3.7.0","v3.6.1","v3.6.0","v3.5.1","v3.5.0","v3.4.0","v3.3.2","v3.3.1","v3.3.0","v3.2.1","v3.2.0","v3.1.0","v3.0.1","v3.0.0","v2.9.0","v2.8.1","v2.8.0","v2.7.1","v2.7.0","v2.6.2","v2.6.1","v2.6.0","v2.5.2","v2.5.1","v2.5.0","v2.4.1","v2.4.0","v2.3.2","v2.3.1","v2.3.0","v2.2.2","v2.2.1","v2.2.0","v2.1.4","v2.1.3","v2.1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35784.json","vanir_signatures_modified":"2026-08-27T08:55:12Z","vanir_signatures":[{"digest":{"line_hashes":["318029086928463328978880662858799719559","38581269024580834936979536530738007553","289431370978073966754050857004753806111","237554259802663005882124020248922010992","55220800006065477010725795313990725964"],"threshold":0.9},"id":"CVE-2023-35784-54e5d3b7","signature_type":"Line","signature_version":"v1","source":"https://github.com/libressl/openbsd/commit/ec44842c68b88bb1c93a8d517ef859e8a456a822","target":{"file":"src/lib/libssl/s3_lib.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"275837915516327575572512449369328465332","length":1139},"id":"CVE-2023-35784-55fcfbb8","signature_type":"Function","signature_version":"v1","source":"https://github.com/libressl/openbsd/commit/ec44842c68b88bb1c93a8d517ef859e8a456a822","target":{"file":"src/lib/libssl/s3_lib.c","function":"ssl3_free"}},{"deprecated":false,"digest":{"function_hash":"275837915516327575572512449369328465332","length":1139},"id":"CVE-2023-35784-6b7f9c19","signature_type":"Function","signature_version":"v1","source":"https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54","target":{"file":"src/lib/libssl/s3_lib.c","function":"ssl3_free"}},{"deprecated":false,"digest":{"function_hash":"179503027444079463257166586757167826824","length":1018},"id":"CVE-2023-35784-6d3514d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/libressl/openbsd/commit/242532e946dd73e728b67bfe0915634d91462442","target":{"file":"src/lib/libssl/s3_lib.c","function":"ssl3_free"}},{"deprecated":false,"digest":{"line_hashes":["318029086928463328978880662858799719559","38581269024580834936979536530738007553","289431370978073966754050857004753806111","237554259802663005882124020248922010992","55220800006065477010725795313990725964"],"threshold":0.9},"id":"CVE-2023-35784-81ca270c","signature_type":"Line","signature_version":"v1","source":"https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54","target":{"file":"src/lib/libssl/s3_lib.c"}},{"digest":{"line_hashes":["318029086928463328978880662858799719559","167570896660061044803044394243221479805","236761717147379022131078656568025718482","280851328767504689644122720762551246455","111262196369619851026950638376073380677"],"threshold":0.9},"id":"CVE-2023-35784-cc4e1e37","signature_type":"Line","signature_version":"v1","source":"https://github.com/libressl/openbsd/commit/242532e946dd73e728b67bfe0915634d91462442","target":{"file":"src/lib/libssl/s3_lib.c"},"deprecated":false}]}}],"schema_version":"1.9.0"}