PT-2023-15779 · Openbsd+1 · Libressl+2

Ilya Shipitsin · Publicado 2022-11-05 · Atualizado 2023-09-16 · CVE-2022-48437

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreSSL versions prior to 3.6.1 OpenBSD versions prior to 7.2 errata 001

Description An issue was discovered in the x509/x509 verify.c file. The function x509 verify ctx add chain does not store errors that occur during leaf certificate verification, resulting in an incorrect error being returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate.

Recommendations For LibreSSL versions prior to 3.6.1, update to version 3.6.1 or later to resolve the issue. For OpenBSD versions prior to 7.2 errata 001, apply the 7.2 errata 001 patch to resolve the issue. As a temporary workaround, consider disabling the installed verification callback that instructs the verifier to continue upon detecting an invalid certificate until a patch is available.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2022-3009

ALT-PU-2023-4398

ALT-PU-2023-5593

CVE-2022-48437

Produtos afetados

Alt Linux

Libressl

Openbsd

Referências · 25

• https://github.com/openbsd/src/commit/4f94258c65a918ee3d8670e93916d15bf879e6ec · Correção
• https://github.com/libressl-portable/openbsd/issues/126 · Nota
• https://safe-surf.ru/specialists/bulletins-nkcki/692167 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0286 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48437 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2022-48437 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46880 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2023-5593 · Aviso do Fabricante
• https://t.me/cibsecurity/61961 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41581 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2022-48437 · Nota
• https://safe-surf.ru/specialists/bulletins-nkcki/691089 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-48437 · Aviso do Fabricante
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/001_x509.patch.sig · Correção