CVE-2017-8301: Medium severity libressl vulnerability
LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSLgetverifyresult is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8301?
CVE-2017-8301 has a moderate severity level due to the potential for accepting invalid TLS certificates.
How do I fix CVE-2017-8301?
To fix CVE-2017-8301, upgrade LibreSSL to version 2.5.4 or later to ensure proper TLS certificate verification.
Which versions of LibreSSL are affected by CVE-2017-8301?
CVE-2017-8301 affects LibreSSL versions 2.5.1, 2.5.2, and 2.5.3.
What is the impact of CVE-2017-8301?
The impact of CVE-2017-8301 includes potential exposure to man-in-the-middle attacks by accepting invalid certificates.
Is CVE-2017-8301 relevant for nginx users?
Yes, CVE-2017-8301 is particularly relevant for nginx users who rely on user-provided verification callbacks.