Richard Levitte

The issue is related to the generation and checking of excessively long X9.42 DH keys or parameters, which may cause long delays in applications using the affected functions. This can lead to a Denial of Service attack if the key or parameters are obtained from an untrusted source. The `DH generate key()` and `DH check pub key()` functions are vulnerable to excessively large P and Q parameters. Other affected functions include `DH check pub key ex()`, `EVP PKEY public check()`, and `EVP PKEY generate()`. The OpenSSL pkey command line application and the OpenSSL genpkey command line application are also vulnerable when using the "-pubcheck" option.

The issue is related to the processing of specially crafted ASN.1 object identifiers, which can cause significant delays in applications using the OpenSSL library. This can lead to a Denial of Service (DoS) condition. The `OBJ obj2txt()` function is used to translate an ASN.1 OBJECT IDENTIFIER to its canonical numeric text form, and when dealing with very large sub-identifiers, the translation can take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes. The impact is relatively low on TLS due to the 100KiB limit on the peer's certificate chain. Applications that call `OBJ obj2txt()` directly with untrusted data are affected, with any version of OpenSSL.