CVE-2023-0466

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-0466
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-0466.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-0466
Downstream
Related
Published
2023-03-28T15:15:06Z
Modified
2025-10-07T23:55:17.670233Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

The function X509VERIFYPARAMadd0policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.

As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509VERIFYPARAMadd0policy() function.

Instead the applications that require OpenSSL to perform certificate policy check need to use X509VERIFYPARAMset1policies() or explicitly enable the policy check by calling X509VERIFYPARAMsetflags() with the X509VFLAGPOLICYCHECK flag argument.

Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.

References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events

Affected versions

openssl-3.*

openssl-3.0.0
openssl-3.0.1
openssl-3.0.2
openssl-3.0.3
openssl-3.0.4
openssl-3.0.5
openssl-3.0.6
openssl-3.0.7
openssl-3.0.8