OpenSSL up to 1.0.2/1.1.1/3.0/3.1 Certificate Policy Check X509_VERIFY_PARAM_add0_policy certificate validation

Summaryinfo

A vulnerability labeled as critical has been found in OpenSSL up to 1.0.2/1.1.1/3.0/3.1. Affected by this issue is the function X509_VERIFY_PARAM_add0_policy of the component Certificate Policy Check Handler. Such manipulation leads to certificate validation. This vulnerability is uniquely identified as CVE-2023-0466. The attack can be launched remotely. No exploit exists. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in OpenSSL up to 1.0.2/1.1.1/3.0/3.1 (Network Encryption Software). Affected by this issue is the function X509_VERIFY_PARAM_add0_policy of the component Certificate Policy Check Handler. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.

The weakness was disclosed 03/28/2023 as 20230328.txt. The advisory is shared for download at openssl.org. This vulnerability is handled as CVE-2023-0466 since 01/24/2023. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/26/2024). The MITRE ATT&CK project declares the attack technique as T1587.003.

The vulnerability scanner Nessus provides a plugin with the ID 211827 (Oracle Linux 9 : edk2 (ELSA-2024-12842)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 0d16b7e99aafc0b4a6d729eec65a411a7e025f0a is able to eliminate this problem. The bugfix is ready for download at git.openssl.org.

The vulnerability is also documented in the vulnerability database at Tenable (211827). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 1.0.2
• 1.1.1
• 3.0
• 3.1

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion