CVEvulnerability

CVE-2015-1793

6.5 MEDIUM Published 2015-07-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-07-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-254

Description

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Affected configurations

• oracle supply chain products suite 6.1.2.2 • oracle supply chain products suite 6.1.3.0 • oracle supply chain products suite 6.2.0 • oracle jd edwards enterpriseone tools 9.1 • oracle jd edwards enterpriseone tools 9.2 • openssl openssl 1.0.1n • openssl openssl 1.0.1o • openssl openssl 1.0.2b • openssl openssl 1.0.2c • oracle opus 10g ethernet switch family (<= 2.0.0.6)

Related

Weakness · not in database (1)

References