PT-2023-15779 · Openbsd+1 · Libressl+2

Ilya Shipitsin · Published 2022-11-05 · Updated 2023-09-16 · CVE-2022-48437

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreSSL versions prior to 3.6.1 OpenBSD versions prior to 7.2 errata 001

Description An issue was discovered in the x509/x509 verify.c file. The function x509 verify ctx add chain does not store errors that occur during leaf certificate verification, resulting in an incorrect error being returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate.

Recommendations For LibreSSL versions prior to 3.6.1, update to version 3.6.1 or later to resolve the issue. For OpenBSD versions prior to 7.2 errata 001, apply the 7.2 errata 001 patch to resolve the issue. As a temporary workaround, consider disabling the installed verification callback that instructs the verifier to continue upon detecting an invalid certificate until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2022-3009

ALT-PU-2023-4398

ALT-PU-2023-5593

CVE-2022-48437

Affected Products

Alt Linux

Libressl

Openbsd

References · 25

• https://github.com/openbsd/src/commit/4f94258c65a918ee3d8670e93916d15bf879e6ec · Patch
• https://safe-surf.ru/specialists/bulletins-nkcki/692167 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0286 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48437 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48437 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46880 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712 · Security Note
• https://errata.altlinux.org/ALT-PU-2023-5593 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41581 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/691089 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48437 · Vendor Advisory
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/001_x509.patch.sig · Patch
• https://safe-surf.ru/specialists/bulletins-nkcki/693241 · Security Note
• https://bdu.fstec.ru/vul/2023-00665 · Security Note
• https://bdu.fstec.ru/vul/2021-04571 · Security Note