OpenSSL up to 1.0.2/1.1.1/3.0/3.1 Leaf Certificate crypto/x509/x509_vfy.c check_policy certificate validation

Summaryinfo

A vulnerability identified as critical has been detected in OpenSSL up to 1.0.2/1.1.1/3.0/3.1. Affected by this vulnerability is the function check_policy of the file crypto/x509/x509_vfy.c of the component Leaf Certificate Handler. This manipulation causes certificate validation. This vulnerability is handled as CVE-2023-0465. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability classified as critical was found in OpenSSL up to 1.0.2/1.1.1/3.0/3.1 (Network Encryption Software). Affected by this vulnerability is the function check_policy of the file crypto/x509/x509_vfy.c of the component Leaf Certificate Handler. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

The weakness was released 03/28/2023 as 20230328.txt. It is possible to read the advisory at openssl.org. This vulnerability is known as CVE-2023-0465 since 01/24/2023. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/19/2025). The attack technique deployed by this issue is T1587.003 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 211827 (Oracle Linux 9 : edk2 (ELSA-2024-12842)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 1dd43e0709fece299b15208f36cc7c76209ba0bb is able to eliminate this problem. The bugfix is ready for download at git.openssl.org.

The vulnerability is also documented in the vulnerability database at Tenable (211827). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 1.0.2
• 1.1.1
• 3.0
• 3.1

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion