CVE-2023-33613

What it actually does

Heap buffer overflow in the bi_import function within bigint.c when parsing a private key, resulting in memory corruption that manifests as denial of service.

Why it matters to the business

Attackers can trigger application or service crashes during private-key handling, leading to unplanned downtime and reduced availability for any system relying on the vulnerable axTLS implementation.

How an attack unfolds

An attacker supplies a specially crafted private key to any application that uses the affected axTLS library for cryptographic operations; the malformed key reaches the bi_import routine and overflows a heap buffer, causing the process to crash.

How to fix it

Upgrade instantsoft/icms2 to the commit 7a7e57e77f12f36d0e96be6d5b9066389372dbcd or later that resolves the buffer handling issue in the embedded axTLS code.

How to confirm the fix worked

Confirm the presence of commit 7a7e57e77f12f36d0e96be6d5b9066389372dbcd in the source tree, recompile, and test private-key import with both valid and malformed keys to verify absence of crashes.

Typical attack path

1. Obtain or generate a malformed private key that triggers the overflow condition
2. Deliver the key to the target application through any accepted key-import or configuration path
3. Trigger key parsing in the vulnerable bi_import function
4. Observe process termination or service unavailability

How to detect it

Review application and system logs for abrupt process terminations or segmentation faults that coincide with private-key loading or configuration changes; correlate with any available crash dumps showing heap corruption patterns.

What your security team should do

• Apply the referenced commit to all instances of instantsoft/icms2 without delay
• Inventory other products that embed axTLS 2.1.5 and schedule upgrades
• Add runtime monitoring for unexpected process exits during cryptographic operations