CVE-2023-0466
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-0466
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-0466.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-0466
- Related
- Published
- 2023-03-28T15:15:06Z
- Modified
- 2024-09-11T04:44:00.933219Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The function X509VERIFYPARAMadd0policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.
As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509VERIFYPARAMadd0policy() function.
Instead the applications that require OpenSSL to perform certificate policy check need to use X509VERIFYPARAMset1policies() or explicitly enable the policy check by calling X509VERIFYPARAMsetflags() with the X509VFLAGPOLICYCHECK flag argument.
Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.
- References
-
- https://security.gentoo.org/glsa/202402-08
- https://security.netapp.com/advisory/ntap-20230414-0001/
- https://www.debian.org/security/2023/dsa-5417
- https://www.openssl.org/news/secadv/20230328.txt
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061
- http://www.openwall.com/lists/oss-security/2023/09/28/4
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72
- https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html
- https://security.alpinelinux.org/vuln/CVE-2023-0466
- https://security-tracker.debian.org/tracker/CVE-2023-0466
Affected packages
Alpine:v3.17 / openssl
Package
- Name
- openssl
- Purl
- pkg:apk/alpine/openssl?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.0.8-r3
Affected versions
1.*
3.*
Alpine:v3.18 / openssl
Package
- Name
- openssl
- Purl
- pkg:apk/alpine/openssl?arch=source
Alpine:v3.19 / openssl
Package
- Name
- openssl
- Purl
- pkg:apk/alpine/openssl?arch=source
Alpine:v3.20 / openssl
Package
- Name
- openssl
- Purl
- pkg:apk/alpine/openssl?arch=source
Debian:11 / openssl
Package
- Name
- openssl
- Purl
- pkg:deb/debian/openssl?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.1.1n-0+deb11u5
Debian:12 / openssl
Package
- Name
- openssl
- Purl
- pkg:deb/debian/openssl?arch=source
Debian:13 / openssl
Package
- Name
- openssl
- Purl
- pkg:deb/debian/openssl?arch=source