REDHAT-BUG-2182561: Low severity OpenSSL OpenSSL vulnerability
Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling the X509VERIFYPARAMset1policies()' function.
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a https://www.openssl.org/news/secadv/20230328.txt
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2182561?
The severity of REDHAT-BUG-2182561 is critical due to potential exploitation by a malicious Certificate Authority.
How do I fix REDHAT-BUG-2182561?
To fix REDHAT-BUG-2182561, update OpenSSL to the latest version that addresses this vulnerability.
Who is affected by REDHAT-BUG-2182561?
Applications that utilize non-default options for certificate verification in OpenSSL are affected by REDHAT-BUG-2182561.
What kind of attack is possible with REDHAT-BUG-2182561?
REDHAT-BUG-2182561 allows an attacker to circumvent certificate checks, potentially leading to man-in-the-middle attacks.
Is REDHAT-BUG-2182561 specific to any version of OpenSSL?
REDHAT-BUG-2182561 affects various versions of OpenSSL but details about specific versions can be found in the security advisory.