What is CVE-2023-0465?

CVE-2023-0465 is a medium-severity vulnerability affecting applications that use a non-default option when verifying certificates. This vulnerability allows a malicious Certificate Authority (CA) to circumvent certain checks, potentially compromising the security of systems using OpenSSL. Systems affected include those using OpenSSL versions from 1.0.2 up to 1.0.2zh, 1.1.1 up to 1.1.1u, 3.0.0 up to 3.0.9, and 3.1.0 up to 3.1.1. The vulnerability is particularly concerning for systems handling leaf certificates.

Who is impacted by this?

Users impacted by CVE-2023-0465 are those using applications that verify certificates with a non-default option. This vulnerability allows a malicious CA to bypass certain checks, compromising security. The affected OpenSSL versions are 1.0.2 to 1.0.2zh, 1.1.1 to 1.1.1u, 3.0.0 to 3.0.9, and 3.1.0 to 3.1.1. Systems handling leaf certificates are particularly at risk.

What should I do if I’m affected?

If you're affected by the CVE-2023-0465 vulnerability, it's crucial to take action to protect your systems. To mitigate the risk, follow these simple steps:

1. Update to the latest version of OpenSSL that includes the commit addressing the vulnerability.

2. Regularly check for updates and security patches in the OpenSSL repository and apply them as needed.

3. Consider upgrading your OpenSSL packages if you're using Debian 10 Buster.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-0465 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-295, which involves improper certificate validation, potentially compromising security.

Learn More

CVE-2023-0465 is a medium-severity vulnerability that can be mitigated by updating OpenSSL and regularly checking for security patches. For a comprehensive understanding of the vulnerability, its severity, technical details, and affected software configurations, refer to the NVD page or the sources listed below.

• mattcaswell's commit on GitHub

• Tomas Mraz's commit on GitHub

• Debian OpenSSL security update