A type confusion vulnerability in the OpenSSL TimeStamp verification component enables remote attackers to cause a denial of service by providing malformed response files.

This is a type confusion flaw (CWE-754) within the TS_RESP_verify_response function, where an ASN1_TYPE union member is accessed without proper type validation. This allows an unauthenticated remote attacker to trigger a NULL pointer dereference or invalid memory access, resulting in an application crash.

While the CVSS score of 7.5 reflects the potential for a complete service outage, the actual business impact is limited to a Denial of Service (DoS) for applications utilizing the TimeStamp protocol. Given that RFC 3161 is not universally implemented, the operational risk is localized to systems configured to verify external timestamp responses. Organizations should prioritize patching to prevent service disruptions that could impact downstream automated processes.

Immediate Action: Update all instances of the OpenSSL library to the latest patched versions (3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19, or 1.1.1ze) as provided by the vendor.

Proactive Monitoring: Monitor application logs for unexpected crashes or service restarts associated with TLS or Timestamp verification routines.

Compensating Controls: If immediate patching is not feasible, restrict the ability of applications to process untrusted or external TimeStamp Response files from unknown sources.

Public Exploit Available: No

Although this vulnerability is limited to a Denial of Service, it represents a stable, exploitable path for service disruption. Administrators should schedule updates for the OpenSSL library during the next available maintenance window to ensure full system stability and to eliminate the risk of remote application crashes.