diff --git a/backport-CVE-2023-3817-testcase.patch b/backport-CVE-2023-3817-testcase.patch
new file mode 100644
index 0000000000000000000000000000000000000000..1515c7e827b9a0c5ea66c813f1426302dfa87b99
--- /dev/null
+++ b/backport-CVE-2023-3817-testcase.patch
@@ -0,0 +1,37 @@
+From 7a00ecf55fcc60b9a0528b47427e67f5ea7f9adb Mon Sep 17 00:00:00 2001
+From: liningjie <liningjie@xfusion.com>
+Date: Thu, 27 Jul 2023 23:45:25 +0800
+Subject: [PATCH] dhtest.c: Add test of DH_check() with q = p + 1
+
+This must fail with DH_CHECK_INVALID_Q_VALUE and
+with DH_CHECK_Q_NOT_PRIME unset.
+---
+ test/dhtest.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/test/dhtest.c b/test/dhtest.c
+index 7b587f3..729fb91 100644
+--- a/test/dhtest.c
++++ b/test/dhtest.c
+@@ -124,6 +124,18 @@ static int dh_test(void)
+     /* We'll have a stale error on the queue from the above test so clear it */
+     ERR_clear_error();
+ 
++    if (!TEST_ptr(BN_copy(q, p)) || !TEST_true(BN_add(q, q, BN_value_one())))
++        goto err3;
++
++    if (!TEST_true(DH_check(dh, &i)))
++        goto err3;
++    if (!TEST_true(i & DH_CHECK_INVALID_Q_VALUE)
++        || !TEST_false(i & DH_CHECK_Q_NOT_PRIME))
++        goto err3;
++
++    /* We'll have a stale error on the queue from the above test so clear it */
++    ERR_clear_error();
++
+     /*
+      * II) key generation
+      */
+-- 
+2.33.0
+
diff --git a/backport-CVE-2023-3817.patch b/backport-CVE-2023-3817.patch
new file mode 100644
index 0000000000000000000000000000000000000000..929871a354f82804b77f89bbf0ff433130de5885
--- /dev/null
+++ b/backport-CVE-2023-3817.patch
@@ -0,0 +1,61 @@
+From 9002fd07327a91f35ba6c1307e71fa6fd4409b7f Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <tomas@openssl.org>
+Date: Tue, 25 Jul 2023 15:22:48 +0200
+Subject: [PATCH 1/2] DH_check(): Do not try checking q properties if it is
+ obviously invalid
+
+If  |q| >= |p| then the q value is obviously wrong as q
+is supposed to be a prime divisor of p-1.
+
+We check if p is overly large so this added test implies that
+q is not large either when performing subsequent tests using that
+q value.
+
+Otherwise if it is too large these additional checks of the q value
+such as the primality test can then trigger DoS by doing overly long
+computations.
+
+Fixes CVE-2023-3817
+
+Reviewed-by: Matt Caswell <matt@openssl.org>
+Reviewed-by: Paul Dale <pauli@openssl.org>
+Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
+Reviewed-by: Todd Short <todd.short@me.com>
+(Merged from https://github.com/openssl/openssl/pull/21550)
+
+(cherry picked from commit 1c16253f3c3a8d1e25918c3f404aae6a5b0893de)
+(cherry picked from commit 6a1eb62c29db6cb5eec707f9338aee00f44e26f5)
+---
+ crypto/dh/dh_check.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c
+index aef6f9b1b7..fbe2797569 100644
+--- a/crypto/dh/dh_check.c
++++ b/crypto/dh/dh_check.c
+@@ -143,7 +143,7 @@ int DH_check(const DH *dh, int *ret)
+ #ifdef FIPS_MODULE
+     return DH_check_params(dh, ret);
+ #else
+-    int ok = 0, r;
++    int ok = 0, r, q_good = 0;
+     BN_CTX *ctx = NULL;
+     BIGNUM *t1 = NULL, *t2 = NULL;
+     int nid = DH_get_nid((DH *)dh);
+@@ -172,6 +172,13 @@ int DH_check(const DH *dh, int *ret)
+         goto err;
+ 
+     if (dh->params.q != NULL) {
++        if (BN_ucmp(dh->params.p, dh->params.q) > 0)
++            q_good = 1;
++        else
++            *ret |= DH_CHECK_INVALID_Q_VALUE;
++    }
++
++    if (q_good) {
+         if (BN_cmp(dh->params.g, BN_value_one()) <= 0)
+             *ret |= DH_NOT_SUITABLE_GENERATOR;
+         else if (BN_cmp(dh->params.g, dh->params.p) >= 0)
+-- 
+2.33.0
+
diff --git a/openssl.spec b/openssl.spec
index 14a8fae68f35fa813e40fd2998b058061d584965..27954ec59c90bc7a70c0ae8c8c05c0267e9f4cd4 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -2,7 +2,7 @@
 Name:        openssl
 Epoch:       1
 Version:     3.0.8
-Release:     6
+Release:     7
 Summary:     Cryptography and SSL/TLS Toolkit
 License:     OpenSSL and SSLeay
 URL:         https://www.openssl.org/
@@ -30,6 +30,8 @@ Patch18:     backport-Ensure-that-EXFLAG_INVALID_POLICY-is-checked-even-in.patch
 Patch19:     backport-Generate-some-certificates-with-the-certificatePolic.patch
 Patch20:     backport-Fix-documentation-of-X509_VERIFY_PARAM_add0_policy.patch
 Patch21:     backport-CVE-2023-1255.patch
+Patch22:     backport-CVE-2023-3817.patch
+Patch23:     backport-CVE-2023-3817-testcase.patch
 
 BuildRequires: gcc gcc-c++ perl make lksctp-tools-devel coreutils util-linux zlib-devel
 Requires:    coreutils %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -230,6 +232,9 @@ make test || :
 %ldconfig_scriptlets libs
 
 %changelog
+* Wed Aug 2 2023 liningjie <liningjie@xfusion.com> - 1:3.0.8-7
+- fix CVE-2023-3817
+
 * Wed Apr 26 2023 zcwei <u201911736@hust.edu.cn> - 1:3.0.8-6
 - fix CVE-2023-1255