CVE-2015-1793: Medium severity Oracle Supply Chain Products Suite vulnerability
The X509verifycert function in crypto/x509/x509vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2015-1793?
CVE-2015-1793 is classified as a medium severity vulnerability.
How do I fix CVE-2015-1793?
To fix CVE-2015-1793, update your OpenSSL version to 1.0.2d or later.
What systems are affected by CVE-2015-1793?
CVE-2015-1793 affects specific versions of OpenSSL and Oracle Supply Chain Products Suite.
Can CVE-2015-1793 lead to a Certification Authority spoofing?
Yes, CVE-2015-1793 allows remote attackers to spoof a Certification Authority role.
Is CVE-2015-1793 exploitable remotely?
Yes, CVE-2015-1793 can be exploited remotely by attackers.