Orta CVSS 5.3

CVE-2023-0465: Openssl: güvenlik açığı

Yayın: 28 Mart 2023 18:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

Özet bilgiler

Ürün: Openssl Openssl
CVSS v3.1: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: %1,77 (yüzdelik 78)
CWE: CWE-295
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
openssl-openssl	1.0.2	—	1.0.2zh
openssl-openssl	1.1.1	—	1.1.1u
openssl-openssl	3.0.0	—	3.0.9
openssl-openssl	3.1.0	—	3.1.1

Kaynaklar

Uygulamada aç Tüm CVE kayıtları