CVE-2023-6057: Insecure Trust of DSA-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11166)
A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature algorithm. The product does not properly check the certificate chain, allowing an attacker to establish MITM SSL connections to arbitrary sites using a DSA-signed certificate.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6057?
CVE-2023-6057 is classified as a high-severity vulnerability due to the potential for an attacker to exploit improper certificate trust.
How do I fix CVE-2023-6057?
To mitigate CVE-2023-6057, users should update Bitdefender Total Security to the latest version beyond 27.0.25.115.
What systems are affected by CVE-2023-6057?
CVE-2023-6057 affects specific versions of Bitdefender Total Security, particularly those prior to 27.0.25.115.
What type of attack is possible with CVE-2023-6057?
CVE-2023-6057 could allow an attacker to perform a Man-in-the-Middle (MITM) attack by improperly trusting DSA-signed certificates.
Is CVE-2023-6057 being actively exploited?
As of now, there are no confirmed reports of active exploitation of CVE-2023-6057, but it is recommended to apply updates promptly.