What is CVE-2023-0466?

CVE-2023-0466 is a medium-severity vulnerability affecting OpenSSL, a widely used software library for secure communications. Systems using specific OpenSSL versions are at risk, potentially impacting a broad range of secure communication applications.

Who is impacted by CVE-2023-0466?

The impacted versions include OpenSSL 1.0.2 up to 1.0.2zh, 1.1.1 up to 1.1.1u, 3.0.0 up to 3.0.9, and 3.1.0 up to 3.1.1. This issue could potentially impact a broad range of secure communication applications, so it's important for users to be aware of the affected versions.

What should I do if I’m affected?

If you're affected by the CVE-2023-0466 vulnerability, it's important to take action to protect your systems. Follow these simple steps:

1. Identify the affected OpenSSL versions in your environment.

2. Monitor for updates and patches related to the vulnerability.

3. Apply the updates and patches as soon as they become available.

By staying informed and acting promptly, you can minimize the risk associated with this vulnerability.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-0466 vulnerability, also known as Improper Certificate Validation, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was published on March 28, 2023.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-295, which involves improper certificate validation.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the sources below.

• NVD - CVE-2023-0466

• oss-security - Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec