CVE-2023-6055: Improper Certificate Validation in Bitdefender Total Security HTTPS Scanning (VA-11158)
First published: Fri Oct 18 2024(Updated: )
A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the "Server Authentication" specification in the Extended Key Usage extension, the product does not verify the certificate's compliance with the site, deeming such certificates as valid. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website.
Credit: cve-requests@bitdefender.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bitdefender | <27.0.25.115 |
Remedy
An automatic update to product version 27.0.25.115 fixes the issue.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-6055?
CVE-2023-6055 has been assigned a severity rating that indicates a significant risk due to improper certificate validation in Bitdefender Total Security.
How do I fix CVE-2023-6055?
To mitigate CVE-2023-6055, ensure you update Bitdefender Total Security to the latest version beyond 27.0.25.115.
What specific function of Bitdefender Total Security is affected by CVE-2023-6055?
CVE-2023-6055 affects the HTTPS scanning functionality of Bitdefender Total Security.
What is the impact of CVE-2023-6055 on users?
The impact of CVE-2023-6055 allows potential attackers to present fraudulent certificates, compromising secured connections.
Which versions of Bitdefender Total Security are vulnerable to CVE-2023-6055?
Versions of Bitdefender Total Security up to 27.0.25.115 are vulnerable to CVE-2023-6055.
- agent/remedy
- agent/title
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/bitdefender
- canonical/bitdefender