Ilya Shipitsin

**Name of the Vulnerable Software and Affected Versions** LibreSSL versions prior to 3.6.1 OpenBSD versions prior to 7.2 errata 001 **Description** An issue was discovered in the x509/x509 verify.c file. The function x509 verify ctx add chain does not store errors that occur during leaf certificate verification, resulting in an incorrect error being returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate. **Recommendations** For LibreSSL versions prior to 3.6.1, update to version 3.6.1 or later to resolve the issue. For OpenBSD versions prior to 7.2 errata 001, apply the 7.2 errata 001 patch to resolve the issue. As a temporary workaround, consider disabling the installed verification callback that instructs the verifier to continue upon detecting an invalid certificate until a patch is available.

**Name of the Vulnerable Software and Affected Versions** LibreSSL versions prior to 3.4.2 OpenBSD versions prior to 7.0 errata 006 **Description** The issue allows authentication bypass due to an error for an unverified certificate chain sometimes being discarded in the x509 verify.c file. This occurs because the error is not properly handled, leading to potential security risks. **Recommendations** For LibreSSL versions prior to 3.4.2, update to version 3.4.2 or later to resolve the issue. For OpenBSD versions prior to 7.0 errata 006, apply the 7.0 errata 006 update to fix the problem. As a temporary workaround, consider restricting the use of unverified certificate chains until a patch is available.