CVE-2023-0464: Excessive Resource Usage Verifying X.509 Policy Constraints
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.
Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling the X509VERIFYPARAMset1policies()' function.
Other sources
OpenSSL is vulnerable to a denial of service, caused by an error related to the verification of X.509 certificate chains that include policy constraints. By creating a specially crafted certificate chain that triggers exponential use of computational resources, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1n-0+deb10u6Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1n-0+deb11u5Fixed in 3.0.11-1~deb12u2Fixed in 3.1.4-2 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 3.0.9 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
What is CVE-2023-0464?
CVE-2023-0464 is a security vulnerability in OpenSSL related to the verification of X.509 certificate chains that include policy constraints.
How can this vulnerability be exploited?
Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of resources.
Which versions of OpenSSL are affected by CVE-2023-0464?
All supported versions of OpenSSL are affected, including 1.1.1n-0+deb10u6, 1.1.1n-0+deb11u5, 3.0.9-1, and 3.0.11-1.
How can I fix the CVE-2023-0464 vulnerability?
To fix the vulnerability, update to the latest versions of OpenSSL, such as 1.1.1n-0+deb10u6, 1.1.1n-0+deb11u5, 3.0.9-1, or 3.0.11-1.
Where can I find more information about CVE-2023-0464?
You can find more information about CVE-2023-0464 on the official OpenSSL website and in the provided references.