CVE-2023-0465: Invalid certificate policies in leaf certificates are silently ignored
Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.
Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.
Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling the X509VERIFYPARAMset1policies()' function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1n-0+deb10u6Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1n-0+deb11u5Fixed in 3.0.11-1~deb12u2Fixed in 3.1.4-2
Event History
Frequently Asked Questions
What is CVE-2023-0465?
CVE-2023-0465 is a vulnerability that affects applications using a non-default option when verifying certificates, making them vulnerable to attacks from malicious certificate authorities.
How does CVE-2023-0465 impact OpenSSL?
CVE-2023-0465 affects OpenSSL by allowing invalid certificate policies in leaf certificates to be silently ignored and certain certificate policy checks to be skipped.
Which versions of OpenSSL are affected by CVE-2023-0465?
OpenSSL versions 1.1.1n-0+deb10u3 to 1.1.1n-0+deb10u6, 1.1.1n-0+deb11u4 to 1.1.1n-0+deb11u5, 3.0.9-1 to 3.0.11-1 are affected by CVE-2023-0465.
How can I fix CVE-2023-0465 in OpenSSL?
To fix CVE-2023-0465 in OpenSSL, update to version 1.1.1n-0+deb10u6 or higher for Debian 10, and version 1.1.1n-0+deb11u5 or higher for Debian 11.
Where can I find more information about CVE-2023-0465?
You can find more information about CVE-2023-0465 on the OpenSSL security advisory at https://www.openssl.org/news/secadv/20230328.txt and the associated commits in the OpenSSL Git repository.