The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification.
As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function.
Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument.
Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-libsUpgrade openssl-develUpgrade openssl-perlUpgrade openssl | Jun 27, 2023 | Mar 28, 2023 |
| Alpine Linux | — | Upgrade openssl | Mar 26, 2024 | Mar 28, 2023 |
| Amazon Linux Ami 2 | — | Upgrade openssl-snapsafe-staticUpgrade openssl-staticUpgrade edk2-tools-docUpgrade openssl11-debuginfoUpgrade openssl11-libsUpgrade openssl-snapsafe-debuginfoUpgrade edk2-debuginfoUpgrade openssl-snapsafe-perlUpgrade openssl-snapsafe-develUpgrade openssl-snapsafe-libsUpgrade opensslUpgrade openssl11-develUpgrade edk2-toolsUpgrade openssl11Upgrade openssl-perlUpgrade openssl-libsUpgrade openssl-develUpgrade openssl-debuginfoUpgrade openssl-snapsafeUpgrade edk2-tools-pythonUpgrade edk2-ovmfUpgrade openssl11-staticUpgrade edk2-aarch64 | May 17, 2023 | Mar 28, 2023 |
| Amazon_linux | — | Upgrade openssl | Jun 9, 2023 | Mar 28, 2023 |
| Amazon_linux_2023 | — | Upgrade opensslUpgrade openssl-libsUpgrade openssl-perlUpgrade openssl-libs-debuginfoUpgrade openssl-develUpgrade openssl-debugsourceUpgrade openssl-debuginfo | Feb 17, 2025 | Mar 28, 2023 |
| Centos_linux | — | Upgrade openssl-perlUpgrade opensslUpgrade openssl-libs-debuginfoUpgrade openssl-debuginfoUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-debugsource | Jun 22, 2023 | Mar 28, 2023 |
| Debian | — | Upgrade openssl | Jun 2, 2023 | Mar 28, 2023 |
| Dell Poweredge Dsa2024082 | — | Upgrade Dell PowerEdge to the latest version | Oct 23, 2025 | Feb 20, 2024 |
| Freebsd | — | Upgrade opensslUpgrade python37Upgrade python311Upgrade openssl31Upgrade python38Upgrade python310Upgrade python39Upgrade openssl-quicUpgrade openssl30 | Jun 8, 2023 | Jun 8, 2023 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Feb 5, 2024 | Mar 28, 2023 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Mar 28, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-libs | May 9, 2023 | Mar 28, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade sgx-aesm-serviceUpgrade libsgx-ae-leUpgrade libsgx-enclave-commonUpgrade libsgx-launchUpgrade libsgx-aesm-launch-pluginUpgrade libsgx-urts | Jan 10, 2024 | Mar 28, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade openssl-develUpgrade openssl-libsUpgrade opensslUpgrade openssl-perl | Jun 9, 2023 | Mar 28, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade openssl-perlUpgrade openssl-libsUpgrade openssl | Jul 10, 2023 | Mar 28, 2023 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory39 | Sep 12, 2023 | Mar 28, 2023 |
| Oracle_linux | — | Upgrade openssl-develUpgrade openssl-perlUpgrade openssl-libsUpgrade openssl | Jun 22, 2023 | Mar 28, 2023 |
| Rapid7 Insightagent | — | Upgrade Rapid7 Insight Agent to version 4.0.6.14 | Mar 19, 2024 | Mar 28, 2023 |
| Redhat_linux | — | Upgrade openssl-develUpgrade openssl-debuginfoUpgrade openssl-libs-debuginfoUpgrade openssl-libsUpgrade opensslUpgrade openssl-debugsourceUpgrade openssl-perlNo solution exists | Jun 22, 2023 | Mar 28, 2023 |
| Rocky_linux | — | Upgrade openssl-libs-debuginfoUpgrade openssl-fips-provider-debugsourceUpgrade openssl-libsUpgrade openssl-fips-provider-debuginfoUpgrade openssl-perlUpgrade opensslUpgrade openssl-debugsourceUpgrade openssl-debuginfoUpgrade openssl-fips-providerUpgrade openssl-devel | Jul 16, 2024 | Mar 28, 2023 |
| Suse | — | Upgrade libopenssl-1_0_0-develUpgrade libopenssl-3-develUpgrade libopenssl1_0_0-hmacUpgrade openssl-1_1-docUpgrade libopenssl1_0_0-hmac-32bitUpgrade libopenssl1_0_0-32bitUpgrade libopenssl1_0_0Upgrade libopenssl-1_1-devel-32bitUpgrade libopenssl3Upgrade openssl-docUpgrade openssl-1_0_0-cavsUpgrade libopenssl1_0_0-steamUpgrade libopenssl1_1-hmac-32bitUpgrade openssl-1_0_0Upgrade opensslUpgrade libopenssl-3-devel-32bitUpgrade libopenssl1_1-hmacUpgrade openssl-3Upgrade libopenssl1_1-32bitUpgrade openssl-3-docUpgrade openssl-1_1Upgrade libopenssl1-develUpgrade openssl1-docUpgrade libopenssl-1_1-develUpgrade libopenssl-develUpgrade libopenssl1_0_0-steam-32bitUpgrade libopenssl-1_0_0-devel-32bitUpgrade openssl-1_0_0-docUpgrade libopenssl10Upgrade libopenssl3-32bitUpgrade libopenssl1_1Upgrade openssl1 | Apr 10, 2023 | Mar 28, 2023 |
| Ubuntu | — | Upgrade libssl-docUpgrade libssl3Upgrade libssl1.0.0Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade qemu-efi-riscv64Upgrade libssl-doc (Ubuntu Pro)Upgrade openssl1.0Upgrade qemu-efi-loongarch64Upgrade libssl1.1Upgrade ovmfUpgrade qemu-efi-armUpgrade ovmf-ia32Upgrade qemu-efi-aarch64Upgrade openssl (Ubuntu Pro)Upgrade qemu-efiUpgrade openssl | May 1, 2023 | Mar 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub