CVE-2023-0466: Certificate policy check not enabled
Certificate policy check not enabled
Other sources
The function X509VERIFYPARAMadd0policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.
As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509VERIFYPARAMadd0policy() function.
Instead the applications that require OpenSSL to perform certificate policy check need to use X509VERIFYPARAMset1policies() or explicitly enable the policy check by calling X509VERIFYPARAMsetflags() with the X509VFLAGPOLICYCHECK flag argument.
Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1n-0+deb10u6Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1n-0+deb11u5Fixed in 3.0.11-1~deb12u2Fixed in 3.1.4-2 - Configuration
If an application requires OpenSSL to enforce certificate policy checks, explicitly enable policy checking by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument (since X509_VERIFY_PARAM_add0_policy() does not enable the check).
OpenSSL X509 verification parameters Policy checking enablement via X509_VERIFY_PARAM_set_flags() / X509_V_FLAG_POLICY_CHECK = enabled (set flag X509_V_FLAG_POLICY_CHECK) only for applications that require policy checking - Configuration
For applications that require certificate policy checks, call X509_VERIFY_PARAM_set1_policies() to specify the acceptable policies, instead of relying on X509_VERIFY_PARAM_add0_policy() to implicitly enable policy checking.
OpenSSL X509 verification parameters Certificate policies list via X509_VERIFY_PARAM_set1_policies() = set (use application-required policies)
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2023-0466.
What is the severity rating of CVE-2023-0466?
CVE-2023-0466 has a severity rating of 5.3 (medium).
How does CVE-2023-0466 affect OpenSSL?
CVE-2023-0466 affects certain versions of OpenSSL, such as 1.1.1n-0+deb10u6 and 1.1.1n-0+deb11u5.
How can I fix CVE-2023-0466?
To fix CVE-2023-0466, you should update OpenSSL to versions 1.1.1n-0+deb10u6, 1.1.1n-0+deb11u5, 3.0.9-1, or 3.0.11-1.
What CWE category does CVE-2023-0466 belong to?
CVE-2023-0466 belongs to CWE category 295 (Improper Certificate Validation).