CVE-2026-2673

Description

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expectedpreferred key exchange group when its key exchange group configuration includesthe default by using the DEFAULT keyword.Impact summary: A less preferred key exchange may be used even when a morepreferred group is supported by both client and server, if the groupwas not included among the clients initial predicated keyshares.This will sometimes be the case with the new hybrid post-quantum groups,if the client chooses to defer their use until specifically requested bythe server.If an OpenSSL TLS 1.3 servers configuration uses the DEFAULT keyword tointerpolate the built-in default group list into its own configuration, perhapsadding or removing specific elements, then an implementation defect causes theDEFAULT list to lose its tuple structure, and all server-supported groupswere treated as a single sufficiently secure tuple, with the server notsending a Hello Retry Request (HRR) even when a group in a more preferred tuplewas mutually supported.As a result, the client and server might fail to negotiate a mutually supportedpost-quantum key agreement group, such as X25519MLKEM768, if the clientsconfiguration results in only classical groups (such as X25519 being theonly ones in the clients initial keyshare prediction).OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS1.3 key agreement group on TLS servers. The old syntax had a single flatlist of groups, and treated all the supported groups as sufficiently secure.If any of the keyshares predicted by the client were supported by the serverthe most preferred among these was selected, even if other groups supported bythe client, but not included in the list of predicted keyshares would have beenmore preferred, if included.The new syntax partitions the groups into distinct tuples of roughlyequivalent security. Within each tuple the most preferred group included amongthe clients predicted keyshares is chosen, but if the client supports a groupfrom a more preferred tuple, but did not predict any corresponding keyshares,the server will ask the client to retry the ClientHello (by issuing a HelloRetry Request or HRR) with the most preferred mutually supported group.The above works as expected when the servers configuration uses the built-indefault group list, or explicitly defines its own list by directly defining thevarious desired groups and group tuples.No OpenSSL FIPS modules are affected by this issue, the code in question liesoutside the FIPS boundary.OpenSSL 3.6 and 3.5 are vulnerable to this issue.OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.

Risk Information

Associated Vulnerability

Patch Details

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234