Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.
Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.
Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-perlUpgrade openssl-develUpgrade openssl-libsUpgrade openssl | Jun 27, 2023 | Mar 28, 2023 |
| Alpine Linux | — | Upgrade opensslUpgrade openssl3Upgrade openssl1.1-compat | Mar 26, 2024 | Mar 28, 2023 |
| Amazon Linux Ami 2 | — | Upgrade openssl11Upgrade edk2-tools-pythonUpgrade opensslUpgrade openssl-snapsafe-libsUpgrade openssl11-develUpgrade openssl-staticUpgrade openssl-snapsafe-staticUpgrade edk2-debuginfoUpgrade openssl-snapsafe-debuginfoUpgrade openssl-debuginfoUpgrade openssl-snapsafe-perlUpgrade openssl-snapsafe-develUpgrade edk2-toolsUpgrade openssl11-libsUpgrade edk2-ovmfUpgrade openssl11-staticUpgrade openssl-libsUpgrade openssl-develUpgrade edk2-aarch64Upgrade openssl-snapsafeUpgrade openssl11-debuginfoUpgrade openssl-perlUpgrade edk2-tools-doc | May 17, 2023 | Mar 28, 2023 |
| Amazon_linux | — | Upgrade openssl | Jun 9, 2023 | Mar 28, 2023 |
| Amazon_linux_2023 | — | Upgrade openssl-perlUpgrade openssl-libsUpgrade openssl-develUpgrade openssl-libs-debuginfoUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-debugsource | Feb 17, 2025 | Mar 28, 2023 |
| Centos_linux | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-libsUpgrade openssl-debuginfoUpgrade openssl-develUpgrade openssl-libs-debuginfoUpgrade openssl-debugsource | Jun 22, 2023 | Mar 28, 2023 |
| Debian | — | Upgrade openssl | Jun 2, 2023 | Mar 28, 2023 |
| Dell Poweredge Dsa2024082 | — | Upgrade Dell PowerEdge to the latest version | Oct 23, 2025 | Feb 20, 2024 |
| Freebsd | — | Upgrade python39Upgrade openssl31Upgrade openssl30Upgrade openssl-quicUpgrade python310Upgrade opensslUpgrade python311Upgrade python37Upgrade python38 | Jun 8, 2023 | Jun 8, 2023 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Feb 5, 2024 | Mar 28, 2023 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Mar 28, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade shim-aa64-storageUpgrade shim | May 9, 2023 | Mar 28, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade sgx-aesm-serviceUpgrade libsgx-aesm-launch-pluginUpgrade libsgx-launchUpgrade libsgx-ae-leUpgrade libsgx-urtsUpgrade libsgx-enclave-common | Jan 10, 2024 | Mar 28, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade shim-aa64 | Jun 9, 2023 | Mar 28, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade shim-aa64-storageUpgrade shim | Jul 10, 2023 | Mar 28, 2023 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory39 | Sep 12, 2023 | Mar 28, 2023 |
| Oracle_linux | — | Upgrade openssl-perlUpgrade opensslUpgrade openssl-libsUpgrade openssl-devel | Jun 22, 2023 | Mar 28, 2023 |
| Rapid7 Insightagent | — | Upgrade Rapid7 Insight Agent to version 4.0.6.14 | Mar 19, 2024 | Mar 28, 2023 |
| Redhat_linux | — | No solution existsUpgrade openssl-perlUpgrade openssl-libs-debuginfoUpgrade openssl-debuginfoUpgrade openssl-libsUpgrade openssl-develUpgrade openssl-debugsourceUpgrade openssl | Jun 22, 2023 | Mar 28, 2023 |
| Rocky_linux | — | Upgrade openssl-libsUpgrade openssl-perlUpgrade openssl-fips-provider-debugsourceUpgrade openssl-debugsourceUpgrade openssl-libs-debuginfoUpgrade openssl-fips-provider-debuginfoUpgrade openssl-fips-providerUpgrade openssl-develUpgrade opensslUpgrade openssl-debuginfo | Jul 16, 2024 | Mar 28, 2023 |
| Suse | — | Upgrade libopenssl1_1-hmac-32bitUpgrade openssl1Upgrade libopenssl1_0_0-32bitUpgrade libopenssl0_9_8Upgrade libopenssl1_0_0-hmacUpgrade openssl-1_0_0-cavsUpgrade libopenssl1_1Upgrade libopenssl-1_0_0-devel-32bitUpgrade libopenssl-1_0_0-develUpgrade openssl-1_1-docUpgrade libopenssl1_0_0Upgrade opensslUpgrade libopenssl1_0_0-hmac-32bitUpgrade libopenssl1_0_0-steamUpgrade libopenssl1_0_0-steam-32bitUpgrade openssl-docUpgrade libopenssl3Upgrade libopenssl10Upgrade libopenssl0_9_8-hmac-32bitUpgrade libopenssl-3-develUpgrade openssl-3-docUpgrade openssl1-docUpgrade libopenssl1_1-hmacUpgrade openssl-1_0_0-docUpgrade libopenssl-3-devel-32bitUpgrade libopenssl0_9_8-hmacUpgrade openssl-3Upgrade libopenssl0_9_8-32bitUpgrade libopenssl1_1-32bitUpgrade libopenssl3-32bitUpgrade libopenssl1-develUpgrade libopenssl-develUpgrade openssl-1_1Upgrade openssl-1_0_0Upgrade libopenssl-1_1-develUpgrade libopenssl-1_1-devel-32bit | Apr 10, 2023 | Mar 28, 2023 |
| Ubuntu | — | Upgrade openssl (Ubuntu Pro)Upgrade openssl1.0 (Ubuntu Pro) | May 1, 2023 | Mar 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub