PT-2023-12600 · Openbsd+1 · Libressl+2

Ilya Shipitsin + 1 · Published 2022-01-17 · Updated 2023-09-16 · CVE-2021-46880

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreSSL versions prior to 3.4.2 OpenBSD versions prior to 7.0 errata 006

Description The issue allows authentication bypass due to an error for an unverified certificate chain sometimes being discarded in the x509 verify.c file. This occurs because the error is not properly handled, leading to potential security risks.

Recommendations For LibreSSL versions prior to 3.4.2, update to version 3.4.2 or later to resolve the issue. For OpenBSD versions prior to 7.0 errata 006, apply the 7.0 errata 006 update to fix the problem. As a temporary workaround, consider restricting the use of unverified certificate chains until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2022-1067

ALT-PU-2023-4398

ALT-PU-2023-5593

CVE-2021-46880

Affected Products

Alt Linux

Libressl

Openbsd

References · 26

• https://github.com/openbsd/src/commit/3f851282810fa0ab4b90b3b1ecec2e8717ef16f8 · Patch
• https://safe-surf.ru/specialists/bulletins-nkcki/693241 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/692167 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0286 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48437 · Security Note
• https://bdu.fstec.ru/vul/2023-00665 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46880 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712 · Security Note
• https://bdu.fstec.ru/vul/2021-04571 · Security Note
• https://errata.altlinux.org/ALT-PU-2023-5593 · Vendor Advisory
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/006_x509.patch.sig · Patch
• https://errata.altlinux.org/ALT-PU-2023-4398 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46880 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2022-1067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46880 · Security Note