JLSEC-2026-236

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-236.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-236.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2026-236

Upstream

CVE-2023-0465

EUVD-2023-12519

GHSA-77f3-6546-6rj7

Published

2026-04-27T18:33:55.942Z

Modified

2026-04-27T20:32:23.632783006Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Applications that use a non-default option when verifying certificates may be vulnerable to an...

Details

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.

Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.

Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling theX509VERIFYPARAMset1policies()' function.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0465",
            "published": "2023-03-28T15:15:06.820Z",
            "database_specific": {
                "status": "Modified"
            },
            "modified": "2025-02-18T21:15:13.877Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-0465",
            "id": "CVE-2023-0465",
            "imported": "2026-04-27T16:32:37.504Z"
        },
        {
            "html_url": "https://github.com/advisories/GHSA-77f3-6546-6rj7",
            "published": "2023-03-28T15:30:16Z",
            "url": "https://api.github.com/advisories/GHSA-77f3-6546-6rj7",
            "modified": "2025-02-18T21:33:12Z",
            "id": "GHSA-77f3-6546-6rj7",
            "imported": "2026-04-27T16:35:06.597Z"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12519",
            "published": "2023-03-28T14:30:39Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2023-12519",
            "modified": "2025-02-18T20:12:50Z",
            "id": "EUVD-2023-12519",
            "imported": "2026-04-27T16:33:18.347Z"
        }
    ]
}

References

Affected packages

Julia / OpenSSL_jll

Package

Name: OpenSSL_jll
Purl: pkg:julia/OpenSSL_jll?uuid=458c3c95-2e84-50aa-8efc-19380b2a3a95

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.21+0

Introduced

3.0.8+0

Fixed

3.0.9+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-236.json"

Julia / Openresty_jll

Package

Name: Openresty_jll
Purl: pkg:julia/Openresty_jll?uuid=87da34d4-7b1b-5a94-8376-8cb65bf3132c

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.27.1+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-236.json"