发布于3月6日3月6日 Members Ubuntu: USN-6039-1 (CVE-2023-0465): openssl vulnerability Severity 5 CVSS (AV:N/AC:L/Au:N/C:N/I:P/A:N) Published 03/28/2023 Created 05/05/2023 Added 05/01/2023 Modified 02/03/2025 Description Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Solution(s) ubuntu-pro-upgrade-openssl ubuntu-pro-upgrade-openssl1-0 References https://attackerkb.com/topics/cve-2023-0465 CVE - 2023-0465 USN-6039-1 https://ubuntu.com/security/notices/USN-6039-1 https://www.cve.org/CVERecord?id=CVE-2023-0465 https://www.openssl.org/news/secadv/20230328.txt
参与讨论
你可立刻发布并稍后注册。 如果你有帐户，立刻登录发布帖子。
注意：你的帖子需要版主批准后才能看到。