PT-2023-2343 · Openssl+10 · Openssl+10
David Benjamin
·
Publicado
2023-03-08
·
Atualizado
2026-04-27
·
CVE-2023-0464
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenSSL (affected versions not specified)
Description
A security issue has been identified in OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this issue by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the
-policy argument to the command line utilities or by calling the X509 VERIFY PARAM set1 policies() function.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Improper Certificate Validation
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Ibm Aix
Linuxmint
Openssl
Red Hat
Red Os
Suse
Ubuntu
Virtualbox