CVEvulnerability

CVE-2023-0464

7.5 HIGH Published 2023-03-22 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2023-03-22
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-295

Description

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

Affected configurations

• openssl openssl (>= 1.0.2 < 1.0.2zh) • openssl openssl (>= 1.1.1 < 1.1.1u) • openssl openssl (>= 3.0.0 < 3.0.9) • openssl openssl (>= 3.1.0 < 3.1.1)

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References