PT-2023-12600 · Openbsd+1 · Libressl+2

Ilya Shipitsin + 1 · Publicado 2022-01-17 · Atualizado 2023-09-16 · CVE-2021-46880

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreSSL versions prior to 3.4.2 OpenBSD versions prior to 7.0 errata 006

Description The issue allows authentication bypass due to an error for an unverified certificate chain sometimes being discarded in the x509 verify.c file. This occurs because the error is not properly handled, leading to potential security risks.

Recommendations For LibreSSL versions prior to 3.4.2, update to version 3.4.2 or later to resolve the issue. For OpenBSD versions prior to 7.0 errata 006, apply the 7.0 errata 006 update to fix the problem. As a temporary workaround, consider restricting the use of unverified certificate chains until a patch is available.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2022-1067

ALT-PU-2023-4398

ALT-PU-2023-5593

CVE-2021-46880

Produtos afetados

Alt Linux

Libressl

Openbsd

Referências · 26

• https://github.com/openbsd/src/commit/3f851282810fa0ab4b90b3b1ecec2e8717ef16f8 · Correção
• https://github.com/libressl-portable/openbsd/issues/126 · Nota
• https://safe-surf.ru/specialists/bulletins-nkcki/693241 · Nota de Segurança
• https://safe-surf.ru/specialists/bulletins-nkcki/692167 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0286 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48437 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2021-46880 · Nota
• https://bdu.fstec.ru/vul/2023-00665 · Nota de Segurança
• https://t.me/cibsecurity/62216 · Publicação no Telegram
• https://t.me/cvenotify/50692 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46880 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712 · Nota de Segurança
• https://bdu.fstec.ru/vul/2021-04571 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2023-5593 · Aviso do Fabricante
• https://t.me/cvenotify/48979 · Publicação no Telegram