CVE-2023-6057: Insecure Trust of DSA-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11166)
First published: Fri Oct 18 2024(Updated: )
A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature algorithm. The product does not properly check the certificate chain, allowing an attacker to establish MITM SSL connections to arbitrary sites using a DSA-signed certificate.
Credit: cve-requests@bitdefender.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bitdefender | <27.0.25.115 |
Remedy
An automatic update to product version 27.0.25.115 fixes the issue.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-6057?
CVE-2023-6057 is classified as a high-severity vulnerability due to the potential for an attacker to exploit improper certificate trust.
How do I fix CVE-2023-6057?
To mitigate CVE-2023-6057, users should update Bitdefender Total Security to the latest version beyond 27.0.25.115.
What systems are affected by CVE-2023-6057?
CVE-2023-6057 affects specific versions of Bitdefender Total Security, particularly those prior to 27.0.25.115.
What type of attack is possible with CVE-2023-6057?
CVE-2023-6057 could allow an attacker to perform a Man-in-the-Middle (MITM) attack by improperly trusting DSA-signed certificates.
Is CVE-2023-6057 being actively exploited?
As of now, there are no confirmed reports of active exploitation of CVE-2023-6057, but it is recommended to apply updates promptly.
- agent/remedy
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/bitdefender
- canonical/bitdefender